fix(server): improve malformed URL handling in middlewares

[Copilot]

This PR addresses server crashes when encountering malformed URLs in static file serving middleware by centralizing and improving malformed URL handling.

Problem

Vite's development server would crash when encountering malformed URLs, particularly from template engines or user input containing expressions like:

<img src="{% if product[0].image_urls[0] %}{{product[0].image_urls[0]}}{% endif %}" />
<img src="{{malformed}}" />
<img src="%ZZ%invalid" />

The crash occurred because decodeURI() throws an error when given malformed input, causing the entire middleware chain to fail.

Solution

1. Centralized utility function: Moved decodeURIIfPossible from packages/vite/src/node/plugins/html.ts to packages/vite/src/node/utils.ts to make it available across the codebase.

2. Fixed static middleware: Updated both serveStaticMiddleware and serveRawFsMiddleware in packages/vite/src/node/server/middlewares/static.ts to use decodeURIIfPossible instead of decodeURI, gracefully handling malformed URLs by skipping processing rather than crashing.

3. Comprehensive testing: Added E2E tests in playground/html that verify the server doesn't crash with various malformed URL patterns.

Changes

• packages/vite/src/node/utils.ts: Added decodeURIIfPossible function with JSDoc
• packages/vite/src/node/plugins/html.ts: Removed local function, imported from utils
• packages/vite/src/node/server/middlewares/static.ts: Updated both middleware functions to use safe decoding
• playground/html/malformed-url.html: Test page with various malformed URL patterns
• playground/html/__tests__/html.spec.ts: E2E tests for malformed URL handling
• playground/html/vite.config.js: Added malformed-url.html to build inputs

Behavior

When a malformed URL is encountered:

• Before: Server crashes with URIError: URI malformed
• After: Server gracefully skips processing and continues serving other requests

This fix ensures that user input or template engine expressions in HTML attributes don't crash the development server, improving developer experience and application stability.

Fixes #20829
Related to #19397

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• vite.dev
  • Triggering command: /home/REDACTED/.cache/playwright-bin/chromium_headless_shell-1187/chrome-linux/headless_shell --disable-field-trial-config --disable-REDACTED-networking --disable-REDACTED-timer-throttling --disable-REDACTEDing-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-REDACTED-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=AcceptCHFrame,AvoidUnnecessaryBeforeUnloadCheckSync,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Translate,AutoDeElevate --allow-pre-commit-input --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-REDACTEDing --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --no-service-autorun --export-tagged-pdf --disable-search-engine-choice-screen --unsafely-disable-devtools-self-xss-warnings --edge-skip-compat-layer-relaunch --enable-automation --headless --hide-scrollbars --mute-audio --blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4 --no-sandbox --no-sandbox --disable-setuid-sandbox --user-data-dir=/tmp/playwright_chromiumdev_profile-RKuUAy --remote-debugging-pipe --no-startup-window (dns block)
• workers.cloudflare.com

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[bluwy]

I pushed a commit that I think makes the malformed uri warning a little better:

Malformed URI sequence in request URL: /%7B%%20if%20product[0].image_urls[0]%20%%7D%7B%7Bproduct[0].image_urls[0]%7D%7D%7B%%20endif%20%%7D

Previously there wasn't any url logged to debug.

[sapphi-red]

Nice, thanks!