fix: use PathUnescape for filename URL decoding (#1214)

pkg/util/url.go

@@ -66,3 +66,16 @@ func TryUrlQueryUnescape(s string) string {
 	}
 	return s
 }
+
+// TryUrlPathUnescape tries to unescape a URL path-encoded string.
+// Unlike QueryUnescape, PathUnescape does not treat '+' as a space.
+// This is the correct function to use for decoding URL paths and filenames
+// where %2B should decode to '+', not to a space.
+//
+// If unescaping fails, it returns the original string.
+func TryUrlPathUnescape(s string) string {
+	if decoded, err := url.PathUnescape(s); err == nil {
+		return decoded
+	}
+	return s
+}

pkg/util/url_test.go

@@ -149,3 +149,31 @@ func TestTryURLDecode(t *testing.T) {
 		})
 	}
 }
+
+func TestTryUrlPathUnescape(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"normal.txt", "normal.txt"},
+		{"%E7%8F%80%E5%B0%94%E8%AF%BA.zip", "珀尔诺.zip"},
+		{"hello%20world.txt", "hello world.txt"},
+		{"bad%2-text", "bad%2-text"},
+		// The key difference: %2B should decode to + (not space)
+		{"C%2B%2B%20Primer.txt", "C++ Primer.txt"},
+		{"test%2Bfile.txt", "test+file.txt"},
+		// Plus sign in path should remain as-is (not decoded to space)
+		{"test+plus.txt", "test+plus.txt"},
+		// Mixed encoding
+		{"C%2B%2B%20%20Primer%20%20Plus.mobi", "C++  Primer  Plus.mobi"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			got := TryUrlPathUnescape(tt.input)
+			if got != tt.expected {
+				t.Errorf("TryUrlPathUnescape(%q) = %q, want %q", tt.input, got, tt.expected)
+			}
+		})
+	}
+}