fix: improve content normalization fallbacks

Signed-off-by: Suresh Kumar Moharajan <suresh.kumar.m@ibm.com>

Author: Suresh Kumar Moharajan

.secrets.baseline

@@ -8780,31 +8780,31 @@
         "hashed_secret": "a10b98d7340036e9c8c301704f623eddd733cc1a",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 2784,
+        "line_number": 2785,
         "type": "Hex High Entropy String",
         "verified_result": null
       },
       {
         "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 5157,
+        "line_number": 5184,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "fe1bae27cb7c1fb823f496f286e78f1d2ae87734",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 5810,
+        "line_number": 5837,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "2878cbdbbcfa6feafc04b8889f5ecc8c470ba32e",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 5874,
+        "line_number": 5901,
         "type": "Secret Keyword",
         "verified_result": null
       },
@@ -8820,63 +8820,63 @@
         "hashed_secret": "a0f4ea7d91495df92bbac2e2149dfb850fe81396",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 9109,
+        "line_number": 9136,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "a75a7c7b31474f3f04f3a395228ded8d61ee1ae3",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 9158,
+        "line_number": 9185,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "02c593fd9af8254b859d426a76b6cd42847fbec1",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 9256,
+        "line_number": 9224,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "1ded3053d0363079a4e681a3b700435d6d880290",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 9313,
+        "line_number": 9281,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "c00dbbc9dadfbe1e232e93a729dd4752fade0abf",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 14411,
+        "line_number": 14379,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
-        "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
+        "hashed_secret": "f2b14f68eb995facb3a1c35287b778d5bd785511",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 16806,
+        "line_number": 17136,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
-        "hashed_secret": "f2b14f68eb995facb3a1c35287b778d5bd785511",
+        "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 17168,
+        "line_number": 17155,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "dc8002865f92070749b264e76045b04fa3b8de71",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 20845,
+        "line_number": 20813,
         "type": "Secret Keyword",
         "verified_result": null
       }

mcpgateway/services/content_security.py

@@ -383,19 +383,23 @@ def _normalize_input(self, content: str) -> str:
         normalized = html.unescape(normalized)
 
         # URL percent decoding (%3C -> <)
+        url_decoded = normalized
         try:
-            normalized = unquote(normalized)
+            url_decoded = unquote(normalized)
         except Exception:
-            # If URL decoding fails, continue with the current normalized value
-            normalized = normalized
+            # If URL decoding fails, continue with the pre-decoded value
+            logger.debug("URL decoding failed during content normalization", exc_info=True)
+        normalized = url_decoded
 
         # Unicode normalization (NFKC - compatibility decomposition + canonical composition)
         # This catches various Unicode tricks like fullwidth characters
+        unicode_normalized = normalized
         try:
-            normalized = unicodedata.normalize("NFKC", normalized)
+            unicode_normalized = unicodedata.normalize("NFKC", normalized)
         except Exception:
-            # If normalization fails, continue with the current normalized value
-            normalized = normalized
+            # If normalization fails, continue with the pre-normalized value
+            logger.debug("Unicode normalization failed during content normalization", exc_info=True)
+        normalized = unicode_normalized
 
         return normalized