From 1d5f01500d40eea8a9315f5dfba239837ce0157e Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Thu, 14 May 2026 14:55:30 +0800
Subject: [PATCH] fix(matrix): tolerate malformed location params

---
 CHANGELOG.md                                  |  1 +
 .../src/matrix/monitor/location.test.ts       | 37 +++++++++++++++++++
 .../matrix/src/matrix/monitor/location.ts     | 10 ++++-
 3 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 extensions/matrix/src/matrix/monitor/location.test.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d02ab646d26..0d8a04095aa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Docs: https://docs.openclaw.ai
 - Models config/auth: stop inferring provider env-var markers from broad `^[A-Z_][A-Z0-9_]*$` strings, and resolve config-backed provider `apiKey` values only through structured env SecretRefs (`secrets.providers[id]` / `secrets.defaults`), so unrelated env vars cannot accidentally become provider credentials. Thanks @sallyom.
 - Media fetch: skip allocating and buffering the response body for bodyless media responses (HEAD probes and 204-style empty bodies), avoiding wasted heap on streams that carry no payload. Thanks @shakkernerd.
 - CLI/onboarding: forward provider-specific auth flags (e.g. `--openai-api-key`) through the onboarding wizard so they reach provider auth methods via `ctx.opts`, letting `--openai-api-key "$OPENAI_API_KEY"` skip the redundant "use existing env var?" prompt in non-interactive harnesses. (#81669) Thanks @sjf.
+- Matrix: ignore malformed percent-encoding in optional location URI parameters instead of letting a bad `geo:` event abort inbound message handling.
 - Plugins: discover provider plugins from `setup.providers[].envVars` credentials during provider discovery while keeping the deprecated `providerAuthEnvVars` fallback. (#81542) Thanks @JARVIS-Glasses.
 - Docs/Codex harness: clarify that per-agent `CODEX_HOME` isolates `~/.codex` while inherited `HOME` intentionally keeps `.agents` discovery and subprocess user-home state available.
 - CLI/plugins: keep bare plugin and parent-command help on the lightweight path, avoiding plugin registry discovery before rendering help.
diff --git a/extensions/matrix/src/matrix/monitor/location.test.ts b/extensions/matrix/src/matrix/monitor/location.test.ts
new file mode 100644
index 00000000000..97f036d7281
--- /dev/null
+++ b/extensions/matrix/src/matrix/monitor/location.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import { resolveMatrixLocation } from "./location.js";
+import { EventType } from "./types.js";
+
+describe("resolveMatrixLocation", () => {
+  it("decodes encoded geo uri accuracy", () => {
+    const result = resolveMatrixLocation({
+      eventType: EventType.Location,
+      content: {
+        msgtype: EventType.Location,
+        geo_uri: "geo:1.5,2.5;u=%31%30",
+      },
+    });
+
+    expect(result?.context).toMatchObject({
+      LocationLat: 1.5,
+      LocationLon: 2.5,
+      LocationAccuracy: 10,
+    });
+  });
+
+  it("ignores malformed geo uri parameter encoding", () => {
+    const result = resolveMatrixLocation({
+      eventType: EventType.Location,
+      content: {
+        msgtype: EventType.Location,
+        geo_uri: "geo:1.5,2.5;u=%zz",
+      },
+    });
+
+    expect(result?.context).toMatchObject({
+      LocationLat: 1.5,
+      LocationLon: 2.5,
+    });
+    expect(result?.context.LocationAccuracy).toBeUndefined();
+  });
+});
diff --git a/extensions/matrix/src/matrix/monitor/location.ts b/extensions/matrix/src/matrix/monitor/location.ts
index 8317b996e05..26c7f67d48d 100644
--- a/extensions/matrix/src/matrix/monitor/location.ts
+++ b/extensions/matrix/src/matrix/monitor/location.ts
@@ -17,6 +17,14 @@ type GeoUriParams = {
   accuracy?: number;
 };
 
+function decodeGeoUriParamValue(value: string): string {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+
 function parseGeoUri(value: string): GeoUriParams | null {
   const trimmed = value.trim();
   if (!trimmed) {
@@ -51,7 +59,7 @@ function parseGeoUri(value: string): GeoUriParams | null {
       continue;
     }
     const valuePart = rawValue.trim();
-    params.set(key, valuePart ? decodeURIComponent(valuePart) : "");
+    params.set(key, valuePart ? decodeGeoUriParamValue(valuePart) : "");
   }
 
   const accuracyRaw = params.get("u");