From c734af6042b1ceed2b30acacb4787415f2ccaa70 Mon Sep 17 00:00:00 2001
From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Date: Mon, 26 Oct 2026 05:01:39 +0100
Subject: [PATCH] Require hex digits in glTF uri_decode percent escapes

Found while testing crates/model/src/gltf.rs:83-96 (uri_decode)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/model/src/gltf.rs | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/crates/model/src/gltf.rs b/crates/model/src/gltf.rs
index e17d014f6..fad225040 100644
--- a/crates/model/src/gltf.rs
+++ b/crates/model/src/gltf.rs
@@ -87,6 +87,8 @@ pub fn uri_decode(s: &str) -> String {
     while i < b.len() {
         if b[i] == b'%'
             && i + 2 < b.len()
+            && b[i + 1].is_ascii_hexdigit()
+            && b[i + 2].is_ascii_hexdigit()
             && let Ok(v) = u8::from_str_radix(std::str::from_utf8(&b[i + 1..i + 3]).unwrap_or("zz"), 16)
         {
             out.push(v);
@@ -612,3 +614,15 @@ fn primitive(d: &Doc, p: &Value, materials: &[Material]) -> Result<Option<Primit
     }
     Ok(Some(prim))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::uri_decode;
+
+    #[test]
+    fn uri_decode_rejects_signed_hex_pair() {
+        assert_eq!(uri_decode("a%+1b"), "a%+1b");
+        assert_eq!(uri_decode("a%-1b"), "a%-1b");
+        assert_eq!(uri_decode("a%41b"), "aAb");
+    }
+}