fix: encode fileId before building the upload status polling URL

[smarcet]

ref: https://app.clickup.com/t/9014802374/86bbhvqdm

Problem

pollUploadStatus (dropzone/index.js) builds the async-processing status URL as:

const statusUrl = `${baseUrl}/status/${fileId}`;

fileId is interpolated raw. For file-upload-api's simple (non-chunked) upload path, file_id is derived server-side from the original client filename (see companion file-upload-api PR). A filename like HPE_OCPSanJose_Backdrop_20x10ft@50%_Ver1.4_PRINT.pdf produces a file_id with an invalid percent-escape (%_), which breaks the polling fetch() call. The browser reports this as a CORS failure (no CORS headers on the rejected malformed request), the catch block swallows it via this.onError, and the file row stays in "Loading" forever.

Chunked (large) uploads never hit this — they're tracked by dropzone's own clean dzuuid, not a filename-derived id.

Fix

encodeURIComponent(fileId) before building statusUrl. Defense-in-depth alongside the server-side fix (file-upload-api sanitizes file_id at the source) - this protects against any other unsafe character reaching the client regardless of what the server sends.

Testing

• Added test_dropzone_poll_upload_status_encodes_file_id_in_url, red-green verified against the fix.
• npx jest src/components/inputs/dropzone src/components/inputs/upload-input-v3 — 63/63 pass.

Companion fixes (defense-in-depth, separate PRs):

• file-upload-api: sanitize the filename used to build file_id at the source.
• sponsor-services: surface polling failures via a snackbar instead of silently swallowing them.

Summary by CodeRabbit

• Bug Fixes
  • Improved upload status polling for file identifiers containing special characters.
  • Prevented malformed status requests by safely encoding file identifiers in upload URLs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2f7784b4-3c20-4b99-81d6-a8c6186df959

📥 Commits

Reviewing files that changed from the base of the PR and between c00bfc6 and 861a6d0.

📒 Files selected for processing (2)

• src/components/inputs/dropzone/__tests__/dropzone.test.js
• src/components/inputs/dropzone/index.js

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

pollUploadStatus now percent-encodes fileId when it builds the upload status URL. A regression test verifies encoding for URL-sensitive characters such as @ and %.

Changes

Upload status URL encoding

Layer / File(s)	Summary
Encode status URL file identifiers src/components/inputs/dropzone/index.js, src/components/inputs/dropzone/__tests__/dropzone.test.js	pollUploadStatus applies encodeURIComponent to fileId. The asynchronous regression test verifies the encoded URL passed to fetch.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 861a6

The change safely encodes upload status identifiers before constructing the polling URL and includes targeted passing tests; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: encoding fileId before constructing the upload status polling URL.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/poll-upload-status-encode-file-id

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.