Navigating to URL with a percent (%) in a query parameter value fails

[bwajtr]

Description of the bug

I noticed a failure of my Vaadin webapp (Flow version) when navigating to the URL with a query parameter that contains percent, like: http://localhost:8080/article/1038992?tag=10%. Instead of some sensible result, I'm getting "Connection lost" message from Vaadin.

I managed to reproduce something similar with Vaadin Starter app with just the HelloWorld page (version 24.5.5), where navigating to http://localhost:8080/?param=test% results in errors in the javascript console, and no page is shown:

indexhtml-qb7H9qKD.js:71542 Uncaught (in promise) TypeError: Cannot destructure property 'appId' of 'appConfig' as it is undefined.
    at Flow.flowInit (indexhtml-qb7H9qKD.js:71542:15)
    at async Object.action (indexhtml-qb7H9qKD.js:71457:11)

Expected behavior

I'd expect no errors as the percent character should be properly escaped and it should be possible to query for values containing percentages (right?)

Minimal reproducible example

1. Download Vaadin starter for 24.5+
2. Start it up
3. Navigate to localhost:8080?param=test%
4. See the Javascript console

Versions

• Vaadin / Flow version: 24.5.5
• Java version: 21
• OS version: macOS 15.1.1
• Browser version (if applicable): Chrome
• Application Server (if applicable):
• IDE (if applicable): Intellij Idea

[caalador]

On the server I can see the exception:

java.lang.IllegalArgumentException: URLDecoder: Incomplete trailing escape (%) pattern
        at java.base/java.net.URLDecoder.decode(URLDecoder.java:230) ~[na:na]
        at java.base/java.net.URLDecoder.decode(URLDecoder.java:147) ~[na:na]
        at com.vaadin.flow.router.QueryParameters.decode(QueryParameters.java:337) ~[flow-server-24.6-SNAPSHOT.jar:24.6-SNAPSHOT]
        at com.vaadin.flow.router.QueryParameters.makeQueryParamList(QueryParameters.java:158) ~[flow-server-24.6-SNAPSHOT.jar:24.6-SNAPSHOT]

Having it as encoded e.g. %25 instead of % the request passes fine.

[bwajtr]

I'll only add that the initial request to the page does not fail. Only the subsequent request made by Vaadin fails - and it appears that the query string is properly escaped there... so from my point of view something goes sideways in Vaadin Flow server (the Request URL produced by Vaadin for that request is http://localhost:8080/?v-r=init&location=article%2F1038992&query=tag%3D10%25):