fix(otel-web): decode only the requested cookie value

[chenqinggang001]

Description

findCookieValue() calls decodeURIComponent() on the entire
document.cookie string before splitting it:

const decodedCookie = decodeURIComponent(document.cookie);
const cookies = decodedCookie.split(';');

A cookie value may legally contain a bare % — it is not required to be
percent-encoded. So a single unrelated cookie set by anything else on the
domain (foo=100%, a truncated UTF-8 sequence, …) makes every lookup in
this function throw URIError: URI malformed.

Since session tracking calls this on init and again on every session refresh,
the error escapes HyperDX.init(). Applications that initialize the SDK on
their startup path — before mounting the app — get their bootstrap promise
rejected and never render:

Uncaught (in promise) URIError: URI malformed
    at decodeURIComponent (<anonymous>)
    at findCookieValue (...)
    at parseCookieToSessionState (...)
    at updateSessionStatus (...)
    at Object.init (...)      <- otel-web Rum.init
    at Object.init (...)      <- @hyperdx/browser HyperDX.init
    at startRum (...)         <- application code

We hit this in production: a blank page stuck on the loading state, and once
the SDK did start, the same URIError recurring every 60 s from the session
refresh timer.

Fix

Split first, then decode only the value of the cookie that was asked for.

This is a direct port of the upstream fix in splunk-otel-js-web
(#962, merged
2025-02-26), which never made it into this fork — same change, same shape,
including leaving the second decodeURIComponent in
parseCookieToSessionState() untouched.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How has this been tested?

• Two unit tests added to packages/otel-web/test/utils.test.ts: one asserting
  the returned value is decoded, one asserting an unrelated non-encoded cookie
  no longer makes the lookup throw (the second one fails on main). Upstream
  landed the fix without tests; these cover it.
• Both assertions verified in headless Chrome against a real HTTP origin, along
  with a control showing decodeURIComponent(document.cookie) throwing
  URIError on the same cookie jar. I could not get the full Karma suite to
  start locally — its rollup TypeScript step needs .d.ts output from
  @hyperdx/instrumentation-exception, which my workspace build did not
  produce — so CI is the real check here.
• Reproduced originally against the production cookie jar that triggered it.

[changeset-bot]

🦋 Changeset detected

Latest commit: 03c6c1c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@hyperdx/otel-web	Patch
@hyperdx/browser	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[greptile-apps]

Greptile Summary

The PR narrows cookie decoding to the requested cookie value so malformed percent sequences in unrelated cookies no longer disrupt session lookup.

• Splits document.cookie before decoding the matched value.
• Adds browser tests for decoded values and unrelated malformed cookies.
• Adds a patch changeset for @hyperdx/otel-web.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains within the eligible follow-up review scope.

Important Files Changed

Filename	Overview
packages/otel-web/src/utils.ts	Updates cookie lookup to decode only the matched cookie value.
packages/otel-web/test/utils.test.ts	Adds focused coverage for value decoding and unrelated malformed cookies.
.changeset/fix-cookie-decode-uri-error.md	Records the cookie-decoding fix as an @hyperdx/otel-web patch release.

_{Reviews (2): Last reviewed commit: "fix(otel-web): decode only the requested..." | Re-trigger Greptile}

[chenqinggang001]

@wrn14897 Mind taking a look? Small fix in otel-web.

findCookieValue() decodes the whole document.cookie string, so one
unrelated cookie with a bare % makes every lookup throw URIError: URI malformed. It escapes HyperDX.init() — we hit it in production as a page
stuck on loading.

Direct port of signalfx/splunk-otel-js-web#962, plus two regression tests.
Thanks!