Report malformed percent-escapes in Google resource URLs

getGatekeeperClassFor() decoded user-supplied URL parts with a bare
decodeURIComponent(). A bare `%` -- ordinary in a Gmail search or label
like "50% off" -- made it throw `URIError: URI malformed` instead of the
friendly errors the rest of the function raises for bad input.

Route the four user-input decodes in that function through a
decodePercentEncoded() helper that names the offending URL and points at
`%25`. Malformed input is rejected rather than read literally: these
values scope the binding, so guessing at intent could scope it to
something other than what the user thinks they connected.

Fixes #55

Author: sarbojitrana

packages/gatekeeper-google/src/google.ts

@@ -160,6 +160,19 @@ function validateGmailQueryForGrouping(query: string): void {
   if (quote || stack.length > 0) throw new Error("Gmail query has unterminated grouping or quotes.");
 }
 
+// decodeURIComponent(), but a malformed escape (e.g. the bare `%` in a search for "50% off")
+// reports which URL was bad instead of throwing a raw `URIError: URI malformed`. Such input is
+// rejected rather than read literally: these values scope the binding, and guessing at what the
+// user meant could scope it to something other than what they think they connected.
+function decodePercentEncoded(what: string, encoded: string): string {
+  try {
+    return decodeURIComponent(encoded);
+  } catch {
+    throw new Error(
+        `Invalid ${what}: not valid percent-encoded text. Write a literal "%" as "%25".`);
+  }
+}
+
 function getBaseUrl(env: Env) {
   return stripTrailingSlashes(env.BASE_URL || "http://localhost:8787/gatekeeper/google");
 }
@@ -866,7 +879,8 @@ export class GatekeeperUserImpl extends WorkerEntrypoint<Env, GatekeeperUserImpl
     }
 
     if (parsed.hostname === "calendar.google.com" && parsed.pathname.startsWith("/calendar/")) {
-      let calendarId = decodeURIComponent(parsed.pathname.split("/")[2] ?? "");
+      let calendarId = decodePercentEncoded(
+          "Google Calendar URL", parsed.pathname.split("/")[2] ?? "");
       if (!calendarId) {
         throw new Error("Invalid Google Calendar URL: no calendar ID found");
       }
@@ -899,7 +913,7 @@ export class GatekeeperUserImpl extends WorkerEntrypoint<Env, GatekeeperUserImpl
 
       // Synthetic path: /<projectId>/<datasetId>/<tableId> (each segment optional after the first).
       let segments = parsed.pathname.replace(/^\/+|\/+$/g, "").split("/").filter(Boolean)
-          .map(segment => decodeURIComponent(segment));
+          .map(segment => decodePercentEncoded("BigQuery resource URL", segment));
       if (segments.length > 3) {
         throw new Error(
             "BigQuery resource URLs must be /<projectId>, /<projectId>/<datasetId>, " +
@@ -938,11 +952,11 @@ export class GatekeeperUserImpl extends WorkerEntrypoint<Env, GatekeeperUserImpl
       // Gmail's own UI encodes spaces in hash searches as `+`, while
       // decodeURIComponent() only decodes `%20`. Normalize both forms.
       const encodedQuery = hash.slice("#search/".length).replace(/\+/g, " ");
-      const query = decodeURIComponent(encodedQuery);
+      const query = decodePercentEncoded("Gmail search URL", encodedQuery);
       validateGmailQueryForGrouping(query);
       props.searchQuery = query;
     } else if (hash.startsWith("#label/")) {
-      const labelName = decodeURIComponent(hash.slice("#label/".length));
+      const labelName = decodePercentEncoded("Gmail label URL", hash.slice("#label/".length));
       if (!labelName || new TextEncoder().encode(labelName).byteLength > 320) {
         throw new Error("Gmail label name must be between 1 and 320 bytes.");
       }