From d9cf41e5a3ebaa92386967896e384acc5c002c85 Mon Sep 17 00:00:00 2001
From: Autowebassat-blip <autowebassat@gmail.com>
Date: Sun, 14 Jun 2026 07:59:10 +0200
Subject: [PATCH] Handle malformed static paths (#31)

Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
---
 apps/commandboard-web/server.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/apps/commandboard-web/server.js b/apps/commandboard-web/server.js
index 73be072..282c388 100644
--- a/apps/commandboard-web/server.js
+++ b/apps/commandboard-web/server.js
@@ -48,7 +48,12 @@ createServer((request, response) => {
 });
 
 function resolveStaticPath(pathname) {
-  const decodedPath = decodeURIComponent(pathname);
+  let decodedPath;
+  try {
+    decodedPath = decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
   const normalizedPath = normalize(decodedPath).replace(/^(\.\.[/\\])+/, "");
   let candidate = join(distDirectory, normalizedPath);