Handle cookie and OAuth error text without unsafe decoding

Author: Villagers654

frontend/src/App.tsx

@@ -137,8 +137,7 @@ const AppContent: React.FC = () => {
         const params = new URLSearchParams(location.search);
         const oauthError = params.get('oauth_error');
         if (oauthError) {
-            const decodedError = decodeURIComponent(oauthError).replace(/\+/g, ' ');
-            setGlobalError(decodedError);
+            setGlobalError(oauthError);
             clearPendingSignInMethod();
             params.delete('oauth_error');
             const remainingSearch = params.toString();

frontend/src/modules/user/views/ManageProfile.tsx

@@ -33,7 +33,7 @@ export function ManageProfile({ user, onUpdate }: ManageProfileProps) {
         if (oauthError) {
             setStatusModal({
                 title: 'Account Connection Failed',
-                msg: decodeURIComponent(oauthError).replace(/\+/g, ' ')
+                msg: oauthError
             });
             setSearchParams({});
         }

frontend/src/utils/api.ts

@@ -37,9 +37,15 @@ export const getCookie = (name: string): string | null => {
 
     const cookies = document.cookie.split(';');
     for (const c of cookies) {
-        const [key, val] = c.trim().split('=');
-        if (key === name) {
-            return decodeURIComponent(val);
+        const cookie = c.trim();
+        const separator = cookie.indexOf('=');
+        if (separator >= 0 && cookie.slice(0, separator) === name) {
+            try {
+                return decodeURIComponent(cookie.slice(separator + 1));
+            } catch {
+                // A malformed cookie should trigger token refresh, not abort the request.
+                return null;
+            }
         }
     }
     return null;

frontend/tests/utils/api.test.ts

@@ -25,6 +25,16 @@ describe('api utils', () => {
         expect(getCookie('missing')).toBeNull();
     });
 
+    it('preserves equals signs inside cookie values', () => {
+        document.cookie = 'session=abc==; path=/';
+        expect(getCookie('session')).toBe('abc==');
+    });
+
+    it('treats malformed cookie encoding as a missing token', () => {
+        document.cookie = 'XSRF-TOKEN=%E0%A4%A; path=/';
+        expect(getCookie('XSRF-TOKEN')).toBeNull();
+    });
+
     it('adds the xsrf token header for mutating requests', async () => {
         document.cookie = 'XSRF-TOKEN=csrf-token; path=/';
         const handler = (api.interceptors.request as any).handlers[0].fulfilled;