[fixed] Properly escape splats

Author: mjackson

modules/DOMUtils.js

@@ -1,14 +1,11 @@
 export var canUseDOM = !!(
-  (typeof window !== 'undefined' &&
-  window.document && window.document.createElement)
+  typeof window !== 'undefined' && window.document && window.document.createElement
 );
 
 export function getHashPath() {
-  return decodeURI(
-    // We can't use window.location.hash here because it's not
-    // consistent across browsers - Firefox will pre-decode it!
-    window.location.href.split('#')[1] || ''
-  );
+  // We can't use window.location.hash here because it's not
+  // consistent across browsers - Firefox will pre-decode it!
+  return window.location.href.split('#')[1] || '';
 }
 
 export function replaceHashPath(path) {

modules/URLUtils.js

@@ -116,9 +116,9 @@ export function matchPattern(pattern, pathname) {
 
   var remainingPathname, paramValues;
   if (match != null) {
-    paramValues = Array.prototype.slice.call(match, 1).map(
-      (v) => v != null ? decodeURIComponent(v) : v
-    );
+    paramValues = Array.prototype.slice.call(match, 1).map(function (v) {
+      return v != null ? decodeURIComponent(v) : v;
+    });
 
     if (captureRemaining) {
       remainingPathname = paramValues.pop();
@@ -177,7 +177,7 @@ export function formatPattern(pattern, params) {
       );
 
       if (paramValue != null)
-        pathname += paramValue;
+        pathname += encodeURIComponent(paramValue);
     } else if (token === '(') {
       parenCount += 1;
     } else if (token === ')') {

modules/__tests__/URLUtils-test.js

@@ -264,7 +264,7 @@ describe('formatPattern', function () {
 
   describe('when a pattern has one splat', function () {
     it('returns the correct path', function () {
-      expect(formatPattern('/a/*/d', { splat: 'b/c' })).toEqual('/a/b/c/d');
+      expect(formatPattern('/a/*/d', { splat: 'b/c' })).toEqual('/a/b%2Fc/d');
     });
   });