fix: decode both script and stack before making comparison in the priv channel. If decode sequencing fails, return false (#31037)

Author: AtofStryker

.circleci/workflows.yml

@@ -82,7 +82,7 @@ windowsWorkflowFilters: &windows-workflow-filters
       - equal: [ develop, << pipeline.git.branch >> ]
       # use the following branch as well to ensure that v8 snapshot cache updates are fully tested
       - equal: [ 'update-v8-snapshot-cache-on-develop', << pipeline.git.branch >> ]
-      - equal: [ 'chore/browser_spike', << pipeline.git.branch >> ]
+      - equal: [ 'fix/em_dash_priv_command', << pipeline.git.branch >> ]
       - matches:
           pattern: /^release\/\d+\.\d+\.\d+$/
           value: << pipeline.git.branch >>

cli/CHANGELOG.md

@@ -3,6 +3,10 @@
 
 _Released 2/11/2025 (PENDING)_
 
+**Bugfixes:**
+
+- Fixed an issue in Cypress [`14.0.2`](https://docs.cypress.io/guides/references/changelog#14-0-2) where privileged commands did not run correctly when a spec file or support file contained certain encoded characters. Fixes [#31034](https://github.com/cypress-io/cypress/issues/31034) and [#31060](https://github.com/cypress-io/cypress/issues/31060).
+
 **Dependency Updates:**
 
 - Upgraded `compression` from `1.7.4` to `1.7.5`. Addressed in [#31004](https://github.com/cypress-io/cypress/pull/31004).

packages/driver/cypress/e2e/issues/issue—31034.cy.js

@@ -0,0 +1,7 @@
+// @see https://github.com/cypress-io/cypress/issues/31034
+describe('issue #31034', { browser: '!webkit' }, () => {
+  it('is able to run privileged commands when there is a em dash (—) in the spec name', () => {
+    cy.visit('/fixtures/files-form.html')
+    cy.get('#basic').selectFile('cypress/fixtures/valid.json')
+  })
+})

packages/server/lib/privileged-commands/privileged-channel.js

@@ -92,15 +92,17 @@
         script = replace.call(script, queryStringRegex, '')
       }
 
-      // stack URLs come in URI encoded by default.
-      // we need to make sure our script names are also URI encoded
-      // so the comparisons match
-      let scriptName = encodeURI(script)
+      // stack URLs come in encoded by default (similar to URI but not entirely accurate).
+      // we need to make sure our script and stack are both decoded entirely to make sure the comparisons are accurate.
+      try {
+        const decodedScript = decodeURIComponent(script)
 
-      // we do NOT want to encode backslashes (\) as this causes pathing issues on Windows
-      scriptName = scriptName.replace(/%5C/g, '\\')
+        const decodedStack = decodeURIComponent(err.stack)
 
-      return stringIncludes.call(err.stack, scriptName)
+        return stringIncludes.call(decodedStack, decodedScript)
+      } catch (e) {
+        return false
+      }
     })
 
     return filteredLines.length > 0