Inconsistent validation of percent-encoded file URLs compared to Node.js

[kevgeoleo]

What version of Bun is running?

1.3.11-canary.1+9e93bfa1b

What platform is your computer?

Linux 5.10.0-12-amd64 x86_64 x86_64

What steps can reproduce the bug?

Hi,

I would like to report a behavior in Bun that can be reproduced using the below snippet:

import { fileURLToPath } from 'node:url';
import { dirname, join } from 'node:path';

const __dirname = dirname(fileURLToPath(import.meta.url));
const filePath = join(__dirname, '% users.txt');
const fileUrl = new URL(`file://${process.platform === 'win32' ? '/' : ''}${filePath.replace(/\\/g, '/')}`);
const roundTrippedPath = fileURLToPath(fileUrl);

What is the expected behavior?

root@KContainer:~/7094# node a.mjs
node:internal/url:1576
  return StringPrototypeIncludes(pathname, '%') ? decodeURIComponent(pathname) : pathname;
                                                  ^

URIError: URI malformed
    at decodeURIComponent (<anonymous>)
    at getPathFromURLPosix (node:internal/url:1576:51)
    at fileURLToPath (node:internal/url:1609:63)
    at file:///7094/a.mjs:18:26
    at ModuleJob.run (node:internal/modules/esm/module_job:430:25)
    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:661:26)
    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:101:5)

Node.js v24.13.1

What do you see instead?

Bun does not throw any malformed URI error

Additional information

No response

[robobun]

✅ Reproduced + fixed in #29176.

fileURLToPath was delegating to WebKit's lenient percent-decoder, which treated %%20 as a literal % followed by a space. The fix validates every % is followed by two hex digits, throwing URIError: URI malformed otherwise — matching Node's decodeURIComponent semantics.