Closes #31091

What I did

Fixed text controls being truncated/reverted when users type special characters like /, ., @, *, etc.

Root cause: VALIDATION_REGEXP (/^[a-zA-Z0-9 _-]*$/) in validateArgs rejected any string value containing characters outside the basic alphanumeric set. When validation failed, the arg was silently omitted from the URL. On the next URL read, the control reverted to its initial value — appearing "truncated."

Fix: Split key vs value validation:

• Keys keep the strict allowlist (KEY_REGEXP = /^[a-zA-Z0-9 _-]*$/) — arg names should remain predictable identifiers.
• Values switch to a blocklist (UNSAFE_VALUE_REGEXP) that only rejects characters that would break parsing or enable injection:
  • ; and : — structural delimiters in the args format (key:value;key:value)
  • <, >, ", ` — HTML/script injection vectors
  • Control characters (\x00-\x1F, \x7F)

Both router/utils.ts and parseArgsParam.ts are updated in sync per the existing "keep in sync" comment.

Checklist for Contributors

Testing

The changes in this PR are covered in the following automated tests:

• stories
• unit tests
• integration tests
• end-to-end tests

Manual testing

1. Run a sandbox: yarn task --task sandbox --start-from auto --template react-vite/default-ts
2. Open Storybook in your browser
3. Navigate to any story with a text control (e.g. the Button story's label prop)
4. Type special characters like user@example.com, path/to/file, image.png, Hello, world!
5. Verify the text control preserves the full value (previously it would revert to the initial value on blur)
6. Verify that values with <, >, ", or backticks are still rejected (security)

Documentation

• Add or update documentation reflecting your changes
• If you are deprecating/removing a feature, make sure to update MIGRATION.MD

No documentation changes needed — this is a bugfix to internal validation logic.

Summary by CodeRabbit

• Bug Fixes

  • Updated argument parsing and validation logic to refine handling of special characters in URL parameters and nested values.
  • Improved edge case handling for numeric values and structural delimiter detection.
  • Enhanced validation rules to allow common special characters while blocking unsafe ones.

• Tests

  • Expanded test coverage for special character behavior in parameter values.