formats/odata: handle bad url-encoded subpaths

lib/formats/odata.js

@@ -39,12 +39,19 @@ const getServiceRoot = (subpath) => {
 
 // Given an OData URL subpath, returns a contextStack: [ [ pathName: String, tableId: String? ] ]
 // that the subpath represents.
-const extractPathContext = (subpath) =>
-  // we have to slice(1) to drop the first element, due to the leading /.
-  subpath.split('/').slice(1).map((part) => {
-    const match = /^([^(]+)\('((?:uuid:)?[a-z0-9-]+)'\)$/i.exec(decodeURIComponent(part));
+const extractPathContext = (subpath) => {
+  const rawParts = subpath.split('/').slice(1);
+  let parts;
+  try {
+    parts = rawParts.map(part => decodeURIComponent(part));
+  } catch (err) {
+    throw Problem.user.unparseableODataExpression({ reason: 'URL-decoding failed' });
+  }
+  return parts.map((part) => {
+    const match = /^([^(]+)\('((?:uuid:)?[a-z0-9-]+)'\)$/i.exec(part);
     return (match == null) ? [ part, null ] : [ match[1], match[2] ];
   });
+};
 
 // Given a querystring object, processes the paging information off of it. Always
 // computes the requested window (limit/offset) so that the correct nextUrl can be

test/unit/formats/odata.js

@@ -867,6 +867,12 @@ describe('odata message composition', () => {
         }).should.be.rejected();
       });
 
+      it('should reject if subpath cannot be decoded', () =>
+        fieldsFor(testData.forms.simple).then((fields) => {
+          const submission = mockSubmission('one', testData.instances.simple.one);
+          (() => singleRowToOData(fields, submission, 'http://localhost:8989', "/simple.svc/Submissions%ea('one')", {})).should.throw();
+        }));
+
       // eslint-disable-next-line arrow-body-style
       it('should pass if the toplevel table is correct', () => {
         return fieldsFor(testData.forms.simple).then((fields) => {