From a25448502db9575f00fa88267e5c65e0a0bb7d81 Mon Sep 17 00:00:00 2001
From: Uzair-Ahmed-Shah <msg.uzair@gmail.com>
Date: Mon, 8 Dec 2025 22:37:52 +0530
Subject: [PATCH] Fix #20420: Prevent double decoding of file URL parameter

---
 test/integration/viewer_spec.mjs | 34 ++++++++++++++++++++++++++++++++
 web/app.js                       |  2 +-
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/test/integration/viewer_spec.mjs b/test/integration/viewer_spec.mjs
index 05d5c48bf514d..68f5e69c703ff 100644
--- a/test/integration/viewer_spec.mjs
+++ b/test/integration/viewer_spec.mjs
@@ -1260,6 +1260,40 @@ describe("PDF viewer", () => {
     });
   });
 
+  describe("File param with encoded characters (issue 20420)", () => {
+    let pages;
+
+    beforeEach(async () => {
+      const baseURL = new URL(global.integrationBaseUrl);
+      const url = `${baseURL.origin}/build/generic/web/compressed.tracemonkey-pldi-09.pdf?token=%2Ffoo`;
+      pages = await loadAndWait(
+        encodeURIComponent(url),
+        ".textLayer .endOfContent"
+      );
+    });
+
+    afterEach(async () => {
+      await closePages(pages);
+    });
+
+    it("must not double-decode the file param", async () => {
+      await Promise.all(
+        pages.map(async ([browserName, page]) => {
+          const pdfUrl = await page.evaluate(
+            () => window.PDFViewerApplication.url
+          );
+
+          expect(pdfUrl)
+            .withContext(`In ${browserName}`)
+            .toContain("token=%2Ffoo");
+          expect(pdfUrl)
+            .withContext(`In ${browserName}`)
+            .not.toContain("token=/foo");
+        })
+      );
+    });
+  });
+
   describe("Keyboard scrolling on startup (bug 843653)", () => {
     let pages;
 
diff --git a/web/app.js b/web/app.js
index 3d6b122f0b1ca..3a8b43f505313 100644
--- a/web/app.js
+++ b/web/app.js
@@ -789,7 +789,7 @@ const PDFViewerApplication = {
       const params = parseQueryString(queryString);
       file = params.get("file") ?? AppOptions.get("defaultUrl");
       try {
-        file = new URL(decodeURIComponent(file)).href;
+        file = new URL(file).href;
       } catch {
         file = encodeURIComponent(file).replaceAll("%2F", "/");
       }