From ef80a68de54cc4992b4861866f2baab2eed903cc Mon Sep 17 00:00:00 2001
From: Dave Jong <dave.jong@patchstack.com>
Date: Mon, 28 Sep 2026 16:10:46 +0200
Subject: [PATCH 1/2] Decode request values the way apps read them

Percent-decoding keeps decoding the escapes around a % that starts no
escape, and decodes each run as UTF-8. The urldecode mutation reads + as
a space, as form decoding does, and REQUEST_URI and all read + in the
query as a space while keeping a + in the path literal.

HTML character references decode the same way in normalization and in
the htmlentitydecode mutation: named references such as &colon; and
numeric references without a closing semicolon.

Text mutations (urldecode, htmlentitydecode, base64_decode) applied to a
structured value decode each string inside it and keep the structure,
within the same bounds as the leaf walk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/protect/engine/normalizer.js       |  84 ++++++++----
 src/protect/engine/request.js          |  86 +++++++------
 tests/protect/request-decoding.test.ts | 169 +++++++++++++++++++++++++
 3 files changed, 278 insertions(+), 61 deletions(-)
 create mode 100644 tests/protect/request-decoding.test.ts

diff --git a/src/protect/engine/normalizer.js b/src/protect/engine/normalizer.js
index 7b47c4f..01eb85b 100644
--- a/src/protect/engine/normalizer.js
+++ b/src/protect/engine/normalizer.js
@@ -80,28 +80,45 @@ export function urlDecode(value) {
     while (result !== previous && iterations < MAX_DECODE_ITERATIONS) {
         previous = result;
         iterations++;
-
-        try {
-            result = decodeURIComponent(result);
-        } catch {
-            result = safeUrlDecode(result);
-            break;
-        }
+        result = safeUrlDecode(result);
     }
 
     return result;
 }
 
-function safeUrlDecode(value) {
-    return value.replace(/%([0-9A-Fa-f]{2})/g, (match, hex) => {
+const utf8 = new TextDecoder();
+
+/**
+ * Percent-decode every well-formed escape, whatever else the value contains.
+ *
+ * A `%` that does not start an escape is kept as it is, and does not stop the escapes around it from being
+ * decoded. Each run of escapes is decoded as UTF-8; bytes that are not valid UTF-8 become U+FFFD.
+ */
+export function safeUrlDecode(value) {
+    return value.replace(/(?:%[0-9A-Fa-f]{2})+/g, (run) => {
         try {
-            return String.fromCharCode(parseInt(hex, 16));
+            return decodeURIComponent(run);
         } catch {
-            return match;
+            const bytes = new Uint8Array(run.length / 3);
+            for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(run.slice(i * 3 + 1, i * 3 + 3), 16);
+            return utf8.decode(bytes);
         }
     });
 }
 
+/**
+ * A request target with `+` in its query read as a space, the way query-string parsers read it.
+ *
+ * Only the query is affected: a `+` in the path is a literal `+`. Apply this before percent-decoding, so
+ * an encoded `%2B` still becomes a literal `+`.
+ */
+export function decodeQueryPlus(target) {
+    if (typeof target !== 'string') return target;
+    const query = target.indexOf('?');
+    if (query === -1) return target;
+    return target.slice(0, query + 1) + target.slice(query + 1).replace(/\+/g, ' ');
+}
+
 export function htmlEntityDecode(value) {
     if (typeof value !== 'string') {
         return value;
@@ -113,17 +130,40 @@ export function htmlEntityDecode(value) {
         result = result.split(entity).join(char);
     }
 
-    result = result.replace(/&#(\d+);/g, (match, code) => {
-        const num = parseInt(code, 10);
-        return num > 0 && num < 65536 ? String.fromCharCode(num) : match;
-    });
+    return decodeHtmlEntities(result);
+}
 
-    result = result.replace(/&#x([0-9A-Fa-f]+);/g, (match, hex) => {
-        const num = parseInt(hex, 16);
-        return num > 0 && num < 65536 ? String.fromCharCode(num) : match;
-    });
+/**
+ * Named entities decoded by `decodeHtmlEntities`: the ones that matter in injection contexts plus the
+ * handful every encoder emits. Numeric references are decoded generally, decimal and hex.
+ */
+const NAMED_ENTITIES = {
+    lt: '<', gt: '>', amp: '&', quot: '"', apos: "'",
+    nbsp: '\u00a0', sol: '/', bsol: '\\', colon: ':', lpar: '(', rpar: ')', equals: '=', grave: '`',
+    Tab: '\t', NewLine: '\n', semi: ';', excl: '!', num: '#', dollar: '$', percnt: '%', ast: '*',
+};
 
-    return result;
+/**
+ * Decode HTML character references in one pass.
+ *
+ * The terminating `;` is optional, as it is for a browser reading a numeric reference: `&#58` and
+ * `&#x3a` decode like `&#58;`. One pass means `&amp;lt;` becomes `&lt;`, not `<`.
+ */
+export function decodeHtmlEntities(input) {
+    return input.replace(/&(#[xX][0-9a-fA-F]+|#\d+|[A-Za-z][A-Za-z0-9]*);?/g, (whole, body) => {
+        if (body[0] === '#') {
+            const hex = body[1] === 'x' || body[1] === 'X';
+            const code = Number.parseInt(hex ? body.slice(2) : body.slice(1), hex ? 16 : 10);
+            if (!Number.isFinite(code) || code < 0 || code > 0x10ffff) return whole;
+            try {
+                return String.fromCodePoint(code);
+            } catch {
+                return whole;
+            }
+        }
+
+        return Object.prototype.hasOwnProperty.call(NAMED_ENTITIES, body) ? NAMED_ENTITIES[body] : whole;
+    });
 }
 
 export function removeSqlComments(value) {
@@ -352,8 +392,8 @@ export function normalizeRequest(req, options = {}) {
         query: normalizeObject(requestField(req, 'query') || {}, options),
         body: normalizeObject(body || {}, options),
         headers: normalizeObject(requestField(req, 'headers') || {}, options),
-        url: normalize(url || '', options),
-        originalUrl: normalize(requestField(req, 'originalUrl') || url || '', options),
+        url: normalize(decodeQueryPlus(url || ''), options),
+        originalUrl: normalize(decodeQueryPlus(requestField(req, 'originalUrl') || url || ''), options),
         _rawBody: rawBody
     };
 }
diff --git a/src/protect/engine/request.js b/src/protect/engine/request.js
index 8f9c947..294e8f4 100644
--- a/src/protect/engine/request.js
+++ b/src/protect/engine/request.js
@@ -1,3 +1,4 @@
+import { decodeHtmlEntities, safeUrlDecode } from './normalizer.js';
 import { setOwn } from './own.js';
 
 // Resolvable DATA attributes of an uploaded file part (files.<name>.<attr>). The engine only exposes
@@ -22,44 +23,48 @@ export function base64DecodeUtf8(value) {
   return new TextDecoder().decode(bytes);
 }
 
+// Mutations that decode one string into another.
+const TEXT_MUTATIONS = new Set(['base64_decode', 'urldecode', 'htmlentitydecode']);
+
+// Same bounds as the engine's leaf walk: beyond them a node is kept as it is, still matched undecoded.
+const MAX_MAPPED_NODES = 20000;
+const MAX_MAPPED_DEPTH = 1000;
+
 /**
- * Decode HTML entities, so a payload written as `&lt;script&gt;` is screened as `<script>`.
- *
- * The mutation was documented, used by a shipped rule, and not implemented — so it was applied as a silent
- * no-op. Implemented here to make the name mean what it says, NOT to close a coverage gap: `normalizer.js`
- * already decodes entities across the whole request before matching, iteratively, which is why the
- * entity-encoded payloads that rule exists for were being caught anyway. Anyone reading this should not
- * conclude that entity coverage depended on this mutation; it did not, and the contract test is what turned
- * "the name does nothing" into something visible.
- *
- * Named entities are limited to the ones that matter for injection contexts plus the handful every encoder
- * emits. A full entity table would be a dependency, and the gap it leaves is a payload encoded with an
- * exotic named entity — which no encoder in this path produces. Numeric forms are handled generally, both
- * decimal and hex, because those are what an attacker writes by hand.
+ * A copy of `root` with `fn` applied to every string leaf. Iterative and bounded, so an oversized or
+ * deeply nested value cannot overflow the stack; a shared or cyclic node is copied once.
  */
-const NAMED_ENTITIES = {
-  lt: '<', gt: '>', amp: '&', quot: '"', apos: "'", '#39': "'",
-  nbsp: '\u00a0', sol: '/', bsol: '\\', colon: ':', lpar: '(', rpar: ')', equals: '=', grave: '`',
-  Tab: '\t', NewLine: '\n', semi: ';', excl: '!', num: '#', dollar: '$', percnt: '%', ast: '*',
-};
-
-function decodeHtmlEntities(input) {
-  // One pass. Decoding repeatedly would turn `&amp;lt;` into `<`, which is not what a browser does — and a
-  // guard that decodes further than the sink does is a guard that blocks strings the app never sees.
-  return input.replace(/&(#[xX]?[0-9a-fA-F]+|[A-Za-z][A-Za-z0-9]*);?/g, (whole, body) => {
-    if (body[0] === '#') {
-      const hex = body[1] === 'x' || body[1] === 'X';
-      const code = Number.parseInt(hex ? body.slice(2) : body.slice(1), hex ? 16 : 10);
-      if (!Number.isFinite(code) || code < 0 || code > 0x10ffff) return whole;
-      try {
-        return String.fromCodePoint(code);
-      } catch {
-        return whole;
+function mapStringLeaves(root, fn) {
+  const copies = new Map();
+  const copyOf = (node) => {
+    const copy = Array.isArray(node) ? [] : {};
+    copies.set(node, copy);
+    return copy;
+  };
+  const top = copyOf(root);
+  const stack = [[root, top, 0]];
+  let visited = 0;
+  while (stack.length) {
+    const [node, copy, depth] = stack.pop();
+    visited++;
+    for (const key of Object.keys(node)) {
+      const child = node[key];
+      if (typeof child === 'string') {
+        setOwn(copy, key, fn(child));
+      } else if (child === null || typeof child !== 'object') {
+        setOwn(copy, key, child);
+      } else if (copies.has(child)) {
+        setOwn(copy, key, copies.get(child));
+      } else if (depth + 1 >= MAX_MAPPED_DEPTH || visited + stack.length >= MAX_MAPPED_NODES) {
+        setOwn(copy, key, child);
+      } else {
+        const childCopy = copyOf(child);
+        setOwn(copy, key, childCopy);
+        stack.push([child, childCopy, depth + 1]);
       }
     }
-
-    return Object.prototype.hasOwnProperty.call(NAMED_ENTITIES, body) ? NAMED_ENTITIES[body] : whole;
-  });
+  }
+  return top;
 }
 
 export class RequestResolver {
@@ -175,6 +180,12 @@ export class RequestResolver {
       return value;
     }
 
+    // A text decoder applied to a structured value decodes each string inside it and keeps the structure,
+    // so the matcher still sees every leaf.
+    if (typeof value === 'object' && TEXT_MUTATIONS.has(mutation)) {
+      return mapStringLeaves(value, (leaf) => this.#applyMutation(mutation, leaf));
+    }
+
     switch (mutation) {
       case 'base64_decode':
         try {
@@ -198,11 +209,8 @@ export class RequestResolver {
         }
 
       case 'urldecode':
-        try {
-          return decodeURIComponent(String(value));
-        } catch {
-          return value;
-        }
+        // Form decoding: `+` is a space, and every well-formed escape is decoded even beside a stray `%`.
+        return safeUrlDecode(String(value).replace(/\+/g, ' '));
 
       case 'htmlentitydecode':
         return decodeHtmlEntities(String(value));
diff --git a/tests/protect/request-decoding.test.ts b/tests/protect/request-decoding.test.ts
new file mode 100644
index 0000000..8acdea0
--- /dev/null
+++ b/tests/protect/request-decoding.test.ts
@@ -0,0 +1,169 @@
+import { describe, expect, it } from 'vitest';
+import { RuleEngine } from '../../src/protect/engine/engine.js';
+import { RequestResolver } from '../../src/protect/engine/request.js';
+import { decodeHtmlEntities, safeUrlDecode, urlDecode } from '../../src/protect/engine/normalizer.js';
+import { createProtection } from '../../src/protect/runtime.js';
+
+// Every value below is synthetic. Each case pairs a request the rule must match with one it must not, so a
+// decoder that matches everything fails as surely as one that matches nothing.
+
+function request(overrides: Record<string, unknown> = {}) {
+  return { method: 'GET', url: '/', originalUrl: '/', query: {}, body: {}, headers: {}, ...overrides };
+}
+
+function blocks(condition: object, req: object) {
+  const engine = new RuleEngine({ firewall: [{ id: 1, title: 'sample', rule_v2: [condition] }] });
+  return engine.evaluate(req).blocked;
+}
+
+async function guardBlocks(condition: object, req: Request) {
+  const protection: any = await createProtection({
+    mode: 'block',
+    rules: { firewall: [{ id: 1, title: 'sample', rule_v2: [condition] }], whitelists: [], whitelist_keys: {} },
+  });
+  return (await protection.fetchGuard()(req)) !== null;
+}
+
+describe('percent-decoding beside a stray %', () => {
+  it('decodes the escapes around a % that starts no escape', () => {
+    expect(safeUrlDecode('100% %53AMPLE')).toBe('100% SAMPLE');
+    expect(safeUrlDecode('%zz%41')).toBe('%zzA');
+  });
+
+  it('decodes multi-byte UTF-8 runs and replaces bytes that are not UTF-8', () => {
+    expect(safeUrlDecode('50% caf%C3%A9')).toBe('50% café');
+    expect(safeUrlDecode('%41%FF%42')).toBe('A�B');
+  });
+
+  it('keeps decoding repeated encodings when the value also holds a stray %', () => {
+    expect(urlDecode('50% %253Csample%253E')).toBe('50% <sample>');
+  });
+
+  it('applies the urldecode mutation to a raw body containing a stray %', async () => {
+    const condition = { parameter: 'raw', mutations: ['urldecode'], match: { type: 'contains', value: 'SAMPLE_TOKEN' } };
+    const body = (text: string) => new Request('https://app.example.test/', { method: 'POST', headers: { 'content-type': 'text/plain' }, body: text });
+    expect(await guardBlocks(condition, body('100% %53AMPLE_TOKEN'))).toBe(true);
+    expect(await guardBlocks(condition, body('100% %53AMPLE_OTHER'))).toBe(false);
+  });
+});
+
+describe('+ in form and query data', () => {
+  it('reads + as a space in the query of REQUEST_URI and all', () => {
+    for (const parameter of ['server.REQUEST_URI', 'all']) {
+      const condition = { parameter, match: { type: 'contains', value: 'sample value' } };
+      expect(blocks(condition, request({ url: '/search?q=sample+value', originalUrl: '/search?q=sample+value' }))).toBe(true);
+      expect(blocks(condition, request({ url: '/search?q=sample-value', originalUrl: '/search?q=sample-value' }))).toBe(false);
+    }
+  });
+
+  it('keeps an encoded + and a + in the path literal', () => {
+    const literal = { parameter: 'server.REQUEST_URI', match: { type: 'contains', value: 'a+b' } };
+    expect(blocks(literal, request({ originalUrl: '/search?q=a%2Bb' }))).toBe(true);
+    expect(blocks(literal, request({ originalUrl: '/search?q=a+b' }))).toBe(false);
+    expect(blocks(literal, request({ originalUrl: '/a+b?q=1' }))).toBe(true);
+  });
+
+  it('keeps path scoping on a + in the path', () => {
+    const engine = new RuleEngine({
+      firewall: [{ id: 1, title: 'sample', when: { path: '/a+b' }, rule_v2: [{ parameter: 'get.q', match: { type: 'isset' } }] }],
+    });
+    expect(engine.evaluate(request({ originalUrl: '/a+b?q=1', query: { q: '1' } })).blocked).toBe(true);
+    expect(engine.evaluate(request({ originalUrl: '/a b?q=1', query: { q: '1' } })).blocked).toBe(false);
+  });
+
+  it('reads + as a space in the urldecode mutation', async () => {
+    const condition = { parameter: 'raw', mutations: ['urldecode'], match: { type: 'contains', value: 'sample value' } };
+    const form = (text: string) => new Request('https://app.example.test/', {
+      method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: text,
+    });
+    expect(await guardBlocks(condition, form('q=sample+value'))).toBe(true);
+    expect(await guardBlocks(condition, form('q=sample%2Bvalue'))).toBe(false);
+  });
+});
+
+describe('HTML character references', () => {
+  it.each([
+    ['javascript&colon;run()', 'a named reference'],
+    ['javascript&#58run()', 'a decimal reference without ;'],
+    ['javascript&#x3arun()', 'a hex reference without ;'],
+    ['javascript&#X3A;run()', 'an upper-case hex marker'],
+  ])('decodes %s (%s) before matching', (value) => {
+    const condition = { parameter: 'get.u', match: { type: 'contains', value: 'javascript:' } };
+    expect(blocks(condition, request({ query: { u: value } }))).toBe(true);
+    expect(blocks(condition, request({ query: { u: 'javascript-run()' } }))).toBe(false);
+  });
+
+  it('keeps the text that follows a reference without ;', () => {
+    expect(decodeHtmlEntities('&#58abc')).toBe(':abc');
+    expect(decodeHtmlEntities('&#x3a-xyz')).toBe(':-xyz');
+    expect(decodeHtmlEntities('&unknown;')).toBe('&unknown;');
+  });
+
+  it('decodes one level in the htmlentitydecode mutation', () => {
+    const resolver = new RequestResolver(request());
+    expect(resolver.applyMutations(['htmlentitydecode'], '&amp;lt;')).toBe('&lt;');
+  });
+});
+
+describe('text mutations on structured values', () => {
+  const nested = (value: unknown) => request({ method: 'POST', body: { user: value } });
+
+  it.each([
+    ['urldecode', { profile: { name: '%3Csample%3E' } }, { profile: { name: 'sample' } }],
+    ['base64_decode', { profile: { name: btoa('<sample>') } }, { profile: { name: btoa('sample') } }],
+    ['htmlentitydecode', { list: ['plain', '&lt;sample&gt;'] }, { list: ['plain', 'sample'] }],
+  ])('%s decodes each nested string', (mutation, hit, miss) => {
+    const condition = { parameter: 'post.user', mutations: [mutation], match: { type: 'contains', value: '<sample>' } };
+    expect(blocks(condition, nested(hit))).toBe(true);
+    expect(blocks(condition, nested(miss))).toBe(false);
+  });
+
+  it('keeps the structure for a structural match after decoding', () => {
+    const condition = {
+      parameter: 'post.user', mutations: ['urldecode'],
+      match: { type: 'array_key_value', key: 'items.role', match: { type: 'equals', value: 'admin user' } },
+    };
+    expect(blocks(condition, nested({ items: [{ role: 'guest' }, { role: 'admin+user' }] }))).toBe(true);
+    expect(blocks(condition, nested({ items: [{ role: 'guest' }] }))).toBe(false);
+  });
+
+  it('decodes JSON-decoded containers leaf by leaf', () => {
+    const condition = { parameter: 'post.data', mutations: ['json_decode', 'urldecode'], match: { type: 'contains', value: '<sample>' } };
+    const body = (inner: unknown) => request({ method: 'POST', body: { data: JSON.stringify(inner) } });
+    expect(blocks(condition, body({ deep: [{ value: '%3Csample%3E' }] }))).toBe(true);
+    expect(blocks(condition, body({ deep: [{ value: 'sample' }] }))).toBe(false);
+  });
+
+  it('leaves non-string leaves and the original value unchanged', () => {
+    const value = { count: 3, flag: true, none: null, text: '%41' };
+    const resolver = new RequestResolver(request());
+    expect(resolver.applyMutations(['urldecode'], value)).toEqual({ count: 3, flag: true, none: null, text: 'A' });
+    expect(value.text).toBe('%41');
+  });
+
+  it('terminates on a cyclic value', () => {
+    const value: Record<string, unknown> = { text: '%3Csample%3E' };
+    value.self = value;
+    const resolver = new RequestResolver(request());
+    const decoded = resolver.applyMutations(['urldecode'], value) as Record<string, unknown>;
+    expect(decoded.text).toBe('<sample>');
+    expect(decoded.self).toBe(decoded);
+  });
+
+  it('decodes within its bounds on a deeply nested value without throwing', () => {
+    let value: Record<string, unknown> = { text: '%41' };
+    for (let i = 0; i < 50_000; i++) value = { next: value, text: '%41' };
+    const resolver = new RequestResolver(request());
+    const decoded = resolver.applyMutations(['urldecode'], value) as Record<string, unknown>;
+    expect(decoded.text).toBe('A');
+    expect((decoded.next as Record<string, unknown>).text).toBe('A');
+  });
+
+  it('keeps an own __proto__ key as data', () => {
+    const value = JSON.parse('{"__proto__":{"text":"%3Csample%3E"}}');
+    const resolver = new RequestResolver(request());
+    const decoded = resolver.applyMutations(['urldecode'], value);
+    expect(Object.getPrototypeOf(decoded)).toBe(Object.prototype);
+    expect(Object.getOwnPropertyDescriptor(decoded, '__proto__')?.value).toEqual({ text: '<sample>' });
+  });
+});

From 96bc0d594fa2e401f692ba42597d01eacfb3a0cf Mon Sep 17 00:00:00 2001
From: Dave Jong <dave.jong@patchstack.com>
Date: Mon, 28 Sep 2026 17:02:10 +0200
Subject: [PATCH 2/2] Normalize nested request values to the leaf walk's depth,
 and report the bound

Request normalization walks nested values iteratively, to the same depth
bound as the engine's leaf walk, so every value that walk reaches is
normalized first. A value past the bound is still matched in its raw
form, and reaching the bound is reported as a `container-cap` skip
through `onSkip` and `coverage()`, once per request.

An evaluation result carries the inspection limits it reached as
`skips`, and the resolver records them with `noteSkip`.

Adds coverage for `+` in a request target given only as `url`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/protect/engine/engine.js           |  17 +++-
 src/protect/engine/index.d.ts          |   6 ++
 src/protect/engine/normalizer.js       |  58 +++++++++----
 src/protect/engine/request.js          |  11 +++
 src/protect/runtime.js                 |  13 +++
 tests/protect/request-decoding.test.ts | 112 ++++++++++++++++++++++++-
 6 files changed, 198 insertions(+), 19 deletions(-)

diff --git a/src/protect/engine/engine.js b/src/protect/engine/engine.js
index d616b80..d61ae85 100644
--- a/src/protect/engine/engine.js
+++ b/src/protect/engine/engine.js
@@ -536,6 +536,13 @@ function collectLeafValues(root, nodeCap = 20000, maxDepth = 1000) {
   return out;
 }
 
+// The inspection limits one evaluation reached, as `{ skips: [reason, …] }`, or nothing when it
+// reached none. Callers count each reason in their coverage.
+function skipsOf(resolver) {
+  const skips = resolver?.skips;
+  return skips && skips.length > 0 ? { skips } : {};
+}
+
 // Emit a warning at most once per distinct key (keeps a persistent misconfiguration from spamming).
 const warnedKeys = new Set();
 function warnOnce(key, message) {
@@ -1185,8 +1192,11 @@ export class RuleEngine {
     let normalizedReq;
     let resolver;
     try {
-      normalizedReq = { ...req, ...normalizeRequest(req) };
+      // Past the normalizer's depth bound a value is matched un-normalized; that is reported.
+      let limited = false;
+      normalizedReq = { ...req, ...normalizeRequest(req, { onLimit: () => { limited = true; } }) };
       resolver = new RequestResolver(normalizedReq);
+      if (limited) resolver.noteSkip('container-cap');
     } catch (err) {
       this.#reportError(err);
       return { blocked: false, rule: null, message: null }; // fail open
@@ -1219,7 +1229,8 @@ export class RuleEngine {
             // that re-read the request instead would be reading it a second time: a getter, a stream or
             // anything else that answers once can give a different value, and evidence that disagrees
             // with the match it belongs to is worse than none.
-            resolver
+            resolver,
+            ...skipsOf(resolver)
           };
         }
       } catch (err) {
@@ -1229,7 +1240,7 @@ export class RuleEngine {
       }
     }
 
-    return { blocked: false, rule: null, message: null };
+    return { blocked: false, rule: null, message: null, ...skipsOf(resolver) };
   }
 
   #evaluateRule(conditions, resolver) {
diff --git a/src/protect/engine/index.d.ts b/src/protect/engine/index.d.ts
index cef6924..8287bfd 100644
--- a/src/protect/engine/index.d.ts
+++ b/src/protect/engine/index.d.ts
@@ -44,6 +44,8 @@ export interface EvaluateResult {
   blocked: boolean;
   rule: FirewallRule | null;
   message: string | null;
+  /** Inspection limits this evaluation reached (e.g. `container-cap`), when it reached any. */
+  skips?: string[];
 }
 
 export declare class RuleEngine {
@@ -56,6 +58,8 @@ export declare class RequestResolver {
   constructor(req: any);
   resolve(parameter: string): any[];
   applyMutations(mutations: string[], value: any): any;
+  noteSkip(reason: string): void;
+  readonly skips: string[];
 }
 
 // Middleware
@@ -111,6 +115,8 @@ export interface NormalizeOptions {
   sqlComments?: boolean;
   nullBytes?: boolean;
   whitespace?: boolean;
+  /** Called when a nested value is past the depth bound and is kept un-normalized. */
+  onLimit?: () => void;
 }
 
 export declare function normalize(value: string, options?: NormalizeOptions): string;
diff --git a/src/protect/engine/normalizer.js b/src/protect/engine/normalizer.js
index 01eb85b..186a15c 100644
--- a/src/protect/engine/normalizer.js
+++ b/src/protect/engine/normalizer.js
@@ -398,35 +398,63 @@ export function normalizeRequest(req, options = {}) {
     };
 }
 
-// Depth bound for the recursive walk: a pathologically deep object would otherwise overflow the
-// stack, and the engine's per-rule catch would swallow that into a fail-open. Beyond the bound the
-// sub-value is left un-normalized (still matched, just in its raw form) rather than crashing.
-const MAX_NORMALIZE_DEPTH = 200;
+// The same depth bound as the engine's leaf walk, so every value that walk reaches is normalized. Past
+// it a sub-value is kept as it is (still matched, in its raw form) and `options.onLimit` is called.
+const MAX_NORMALIZE_DEPTH = 1000;
 
+/**
+ * A copy of `value` with every string inside it normalized.
+ *
+ * Iterative, so depth cannot overflow the stack; the work is linear in the size of the value. A shared
+ * or cyclic node is copied once, and array holes stay holes.
+ */
 export function normalizeObject(value, options = {}, depth = 0) {
     if (typeof value === 'string') {
         return normalize(value, options);
     }
 
-    if (depth >= MAX_NORMALIZE_DEPTH) {
+    if (value === null || typeof value !== 'object') {
         return value;
     }
 
-    if (Array.isArray(value)) {
-        return value.map(item => normalizeObject(item, options, depth + 1));
+    if (depth >= MAX_NORMALIZE_DEPTH) {
+        options.onLimit?.();
+        return value;
     }
 
-    if (typeof value === 'object' && value !== null) {
-        const result = {};
-
-        for (const [key, val] of Object.entries(value)) {
-            setOwn(result, key, normalizeObject(val, options, depth + 1));
+    const copies = new Map();
+    const copyOf = (node) => {
+        const copy = Array.isArray(node) ? new Array(node.length) : {};
+        copies.set(node, copy);
+        return copy;
+    };
+    const top = copyOf(value);
+    const stack = [[value, top, depth]];
+
+    while (stack.length > 0) {
+        const [node, copy, level] = stack.pop();
+
+        for (const key of Object.keys(node)) {
+            const child = node[key];
+
+            if (typeof child === 'string') {
+                setOwn(copy, key, normalize(child, options));
+            } else if (child === null || typeof child !== 'object') {
+                setOwn(copy, key, child);
+            } else if (copies.has(child)) {
+                setOwn(copy, key, copies.get(child));
+            } else if (level + 1 >= MAX_NORMALIZE_DEPTH) {
+                setOwn(copy, key, child);
+                options.onLimit?.();
+            } else {
+                const childCopy = copyOf(child);
+                setOwn(copy, key, childCopy);
+                stack.push([child, childCopy, level + 1]);
+            }
         }
-
-        return result;
     }
 
-    return value;
+    return top;
 }
 
 export function createMatchVariants(value) {
diff --git a/src/protect/engine/request.js b/src/protect/engine/request.js
index 294e8f4..dba6a01 100644
--- a/src/protect/engine/request.js
+++ b/src/protect/engine/request.js
@@ -70,12 +70,23 @@ function mapStringLeaves(root, fn) {
 export class RequestResolver {
   #req;
   #cookies;
+  #skips = new Set();
 
   constructor(req) {
     this.#req = req;
     this.#cookies = null;
   }
 
+  /** Record an inspection limit this evaluation reached (reported once per reason). */
+  noteSkip(reason) {
+    this.#skips.add(reason);
+  }
+
+  /** The inspection limits recorded so far, in the order first reached. */
+  get skips() {
+    return [...this.#skips];
+  }
+
   resolve(parameter) {
     if (!parameter || parameter === 'false') {
       return [null];
diff --git a/src/protect/runtime.js b/src/protect/runtime.js
index 51575f0..595dace 100644
--- a/src/protect/runtime.js
+++ b/src/protect/runtime.js
@@ -445,6 +445,10 @@ export async function createProtection(options = {}) {
     // lands after a try/catch here would have returned.
     notify(onSkip, { phase, reason, detail, count: skipCounts[key] }, 'onSkip');
   };
+  // The inspection limits a request-phase evaluation reached (see RuleEngine#evaluate).
+  const recordEvaluationSkips = (result) => {
+    for (const reason of result?.skips ?? []) recordSkip('request', reason);
+  };
 
   const maskFn =
     typeof options.maskWith === 'function'
@@ -535,6 +539,7 @@ export async function createProtection(options = {}) {
     const redactions = [];
     const headerMutations = [];
     let lowerText = null; // lazily lowercased body, only if a rule uses a prefilter
+    const responseSkips = new Set(); // each inspection limit counted once per response
     for (const { rule, engine: re, redactors, prefilter, mutatedSpan } of responseRuleSet) {
       // `only` narrows the set to the rules a caller is entitled to run. The no-body path uses it to
       // exclude every rule that reads the body, rather than evaluating one against an empty string —
@@ -557,6 +562,11 @@ export async function createProtection(options = {}) {
         notify(onError, err, 'onError');
         continue;
       }
+      for (const reason of result.skips ?? []) {
+        if (responseSkips.has(reason)) continue;
+        responseSkips.add(reason);
+        recordSkip('response', reason);
+      }
       if (!result.blocked) continue;
       // Per-rule enforcement applies to every phase, not just the request. A generated response rule in
       // dry-run must not redact or withhold a body either: "detect until justified" is meaningless if the
@@ -705,6 +715,7 @@ export async function createProtection(options = {}) {
         recordSkip('request', shaped._bodyInspectionSkip, { limit: options.maxBodyBytes ?? 1024 * 1024 });
       }
       result = engine.evaluate(shaped);
+      recordEvaluationSkips(result);
     } catch (err) {
       notify(onError, err, 'onError');
 
@@ -1484,6 +1495,7 @@ export async function createProtection(options = {}) {
         const { shaped, client } = shapeExpressRequest(req);
         try {
           result = engine.evaluate(shaped);
+          recordEvaluationSkips(result);
         } catch (err) {
           notify(onError, err, 'onError');
           if (exprOptions.screenResponses) wrapNodeResponse(res, reqContextFromNode(req, client));
@@ -1555,6 +1567,7 @@ export async function createProtection(options = {}) {
           shaped = fromNodeRequest(req, rawBody, { trustedProxy: options.trustedProxy });
           if (parsedBody !== undefined && parsedBody !== null) shaped.body = parsedBody;
           result = engine.evaluate(shaped);
+          recordEvaluationSkips(result);
         } catch (err) {
           notify(onError, err, 'onError');
           return next();
diff --git a/tests/protect/request-decoding.test.ts b/tests/protect/request-decoding.test.ts
index 8acdea0..d0223c2 100644
--- a/tests/protect/request-decoding.test.ts
+++ b/tests/protect/request-decoding.test.ts
@@ -1,7 +1,9 @@
 import { describe, expect, it } from 'vitest';
 import { RuleEngine } from '../../src/protect/engine/engine.js';
 import { RequestResolver } from '../../src/protect/engine/request.js';
-import { decodeHtmlEntities, safeUrlDecode, urlDecode } from '../../src/protect/engine/normalizer.js';
+import {
+  decodeHtmlEntities, normalizeObject, normalizeRequest, safeUrlDecode, urlDecode,
+} from '../../src/protect/engine/normalizer.js';
 import { createProtection } from '../../src/protect/runtime.js';
 
 // Every value below is synthetic. Each case pairs a request the rule must match with one it must not, so a
@@ -56,6 +58,19 @@ describe('+ in form and query data', () => {
     }
   });
 
+  it('reads + as a space in a request target given only as url', () => {
+    const normalized = normalizeRequest({ url: '/search?q=sample+value&r=a%2Bb' });
+    expect(normalized.url).toBe('/search?q=sample value&r=a+b');
+    expect(normalized.originalUrl).toBe('/search?q=sample value&r=a+b');
+    expect(normalizeRequest({ url: '/a+b?q=sample-value' }).url).toBe('/a+b?q=sample-value');
+  });
+
+  it('reads + as a space in url and originalUrl independently', () => {
+    const normalized = normalizeRequest({ url: '/inner?q=first+value', originalUrl: '/outer?q=second+value' });
+    expect(normalized.url).toBe('/inner?q=first value');
+    expect(normalized.originalUrl).toBe('/outer?q=second value');
+  });
+
   it('keeps an encoded + and a + in the path literal', () => {
     const literal = { parameter: 'server.REQUEST_URI', match: { type: 'contains', value: 'a+b' } };
     expect(blocks(literal, request({ originalUrl: '/search?q=a%2Bb' }))).toBe(true);
@@ -167,3 +182,98 @@ describe('text mutations on structured values', () => {
     expect(Object.getOwnPropertyDescriptor(decoded, '__proto__')?.value).toEqual({ text: '<sample>' });
   });
 });
+
+describe('normalization depth', () => {
+  // `levels` nested objects, the innermost holding `text`: the top object is level 0, the innermost is
+  // level `levels - 1`.
+  const nest = (levels: number, text: string) => {
+    let value: Record<string, unknown> = { text };
+    for (let i = 1; i < levels; i++) value = { next: value };
+    return value;
+  };
+  const innermost = (value: any): any => (value.next ? innermost(value.next) : value);
+
+  it('normalizes a value at the deepest level inside the bound, without reporting a limit', () => {
+    let limits = 0;
+    const out = normalizeObject(nest(1000, '%3Csample%3E'), { onLimit: () => { limits++; } });
+    expect(innermost(out).text).toBe('<sample>');
+    expect(limits).toBe(0);
+  });
+
+  it('keeps a value one level past the bound as it is, and reports the limit', () => {
+    let limits = 0;
+    const out = normalizeObject(nest(1001, '%3Csample%3E'), { onLimit: () => { limits++; } });
+    expect(innermost(out).text).toBe('%3Csample%3E');
+    expect(limits).toBe(1);
+  });
+
+  it('reports a limit reached at the top of the walk', () => {
+    let limits = 0;
+    const value = { text: '%41' };
+    expect(normalizeObject(value, { onLimit: () => { limits++; } }, 1000)).toBe(value);
+    expect(limits).toBe(1);
+  });
+
+  it('normalizes nested values well past a few hundred levels', () => {
+    const condition = { parameter: 'post.data', match: { type: 'contains', value: '<sample>' } };
+    const deep = (text: string) => request({ method: 'POST', body: { data: nest(500, text) } });
+    expect(blocks(condition, deep('%3Csample%3E'))).toBe(true);
+    expect(blocks(condition, deep('%3Cother%3E'))).toBe(false);
+  });
+
+  it('normalizes a cyclic value once per node', () => {
+    const value: Record<string, unknown> = { text: '%41' };
+    value.self = value;
+    const out = normalizeObject(value) as Record<string, unknown>;
+    expect(out.text).toBe('A');
+    expect(out.self).toBe(out);
+  });
+
+  it('keeps array holes and non-string leaves', () => {
+    const value = [1, , '%41', null, true];
+    const out = normalizeObject(value) as unknown[];
+    expect(out).toHaveLength(5);
+    expect(1 in out).toBe(false);
+    expect(out).toEqual([1, undefined, 'A', null, true]);
+    expect(normalizeObject(['%41', , ]) as unknown[]).toHaveLength(2);
+  });
+
+  async function screened(body: unknown, onSkip: (event: any) => void, parameter = 'post.data') {
+    const protection: any = await createProtection({
+      mode: 'dry-run',
+      rules: { firewall: [{ id: 1, title: 'sample', rule_v2: [{ parameter, match: { type: 'isset' } }] }], whitelists: [], whitelist_keys: {} },
+      onSkip,
+    });
+    const guard = protection.fetchGuard();
+    const send = () => guard(new Request('https://app.example.test/', {
+      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+    }));
+    return { protection, send };
+  }
+
+  it('reports a request past the bound as a container-cap skip, once per request', async () => {
+    const skips: any[] = [];
+    const { protection, send } = await screened({ data: nest(1001, 'sample'), more: nest(1001, 'sample') }, (event) => skips.push(event));
+    await send();
+    expect(protection.coverage().skipped['request:container-cap']).toBe(1);
+    await send();
+    expect(protection.coverage().skipped['request:container-cap']).toBe(2);
+    expect(skips.map((event) => [event.phase, event.reason])).toEqual([['request', 'container-cap'], ['request', 'container-cap']]);
+  });
+
+  it('reports the skip when no rule matches the request', async () => {
+    const skips: any[] = [];
+    const { protection, send } = await screened({ data: nest(1001, 'sample') }, (event) => skips.push(event), 'post.absent');
+    await send();
+    expect(protection.coverage().skipped['request:container-cap']).toBe(1);
+    expect(skips).toHaveLength(1);
+  });
+
+  it('reports nothing for a request inside the bound', async () => {
+    const skips: any[] = [];
+    const { protection, send } = await screened({ data: nest(999, 'sample') }, (event) => skips.push(event));
+    await send();
+    expect(protection.coverage().skipped['request:container-cap']).toBeUndefined();
+    expect(skips).toEqual([]);
+  });
+});