[Android] Crash when searching with an invalid URL escape code

[kupiakos]

Most of the time searching % crashes the app.

Plan

Premium

Country

USA

Device

Pixel 7

Operating System

Android 14

My Question or Issue

Any search on Spotify Android that contains an invalid URL escape code crashes the app. This includes the following strings:

• test %
• test %2G
• %invalid

This does not include the following, and the search goes normally:

• test %2B (replaces with +)
• test %26 (replaces with &)
• test %25 (replaces with % itself)

I can't reproduce this issue on desktop: the invalid code is left as-is and the search is done normally, instead of replacing with the unescaped character as valid escape code sequences do.

I discovered this when I tried to search for a song title that included the % character.

[kupiakos]

The crash only occurs after pressing the search key on the keyboard - the preview is fine.

Some other observations:

• "test %00" doesn't crash the app, but gives you a "Something went wrong. Have another go?". Consider making the backend more resilient against nul 😁
• "test %01" and other control characters don't really affect the search and are inserted directly.
• Casing of hex characters has no effect.
• Arbitrary UTF-8 sequences work. test "%E2%80%AE foo" (the famous U+202E) renders as "test oof" as expected and "test %f0%9f%8f%b3%ef%b8%8f%e2%80%8d%f0%9f%8c%88" renders as "test 🏳️‍🌈"
• On Android, invalid UTF-8 sequences specified via valid escape codes transform to the U+FFFD replacement character. On desktop, invalid UTF-8 sequences leave the escape codes as-is. 
• There's a lot of content that directly contain this replacement character - in particular a "Kittens and Dogs Music" album with ten different songs containing many copies of the character.
• On desktop, the escape code → text replacement is done automatically when a valid UTF-8 sequence is made, with a slight delay. On Android the replacement is only done with a full search, and it lossily transforms invalid UTF-8 as described.