Escape filenames in URLs

acteng · Dec 10, 2024 · cc71804 · cc71804
1 parent 08a2130
commit cc71804
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/src/lib/common/files.ts b/src/lib/common/files.ts
@@ -26,7 +26,7 @@ export function getEditUrl(
   filename: string,
   schema: Schema,
 ): string {
-  return `scheme.html?authority=${authority}&schema=${schema}&file=${filename}`;
+  return `scheme.html?authority=${authority}&schema=${schema}&file=${encodeURIComponent(filename)}`;
 }
 
 // Returns a list of filenames and the detected schema

diff --git a/src/pages/SketchSchemes.svelte b/src/pages/SketchSchemes.svelte
@@ -36,13 +36,13 @@
   let params = new URLSearchParams(window.location.search);
   // If the authority is invalid, it'll be handled in onMount asynchronously
   let authority = params.get("authority") || "";
-  let filename = params.get("file") || "";
+  let filename = decodeURIComponent(params.get("file") || "");
 
   if (window.localStorage.getItem(getKey(authority, filename)) == null) {
     // If either the filename or authority is wrong, redirect to the very first
     // page. This might be annoying if the authority is correct, but it's
     // simpler. Unless a user copies a bad URL, this shouldn't happen anyway
-    window.location.href = `choose_area.html?schema=${$schema}&error=File ${filename} in authority ${authority} not found`;
+    window.location.href = `choose_area.html?schema=${$schema}&error=File ${encodeURIComponent(filename)} in authority ${authority} not found`;
   }
 
   mapStyle.set(params.get("style") || "streets");