fix: escape dev server breadcrumb hrefs properly (#4316)

DepthFirstDisclosures · web-flow · commit 4a51f0b24d34 · 2025-11-01T14:58:12.000-04:00
diff --git a/pkg/api/serve_other.go b/pkg/api/serve_other.go
@@ -668,7 +668,7 @@ func respondWithDirList(queryPath string, dirEntries map[string]bool, fileEntrie
 	for i, part := range parts {
 		if i+1 < len(parts) {
 			html.WriteString("<a href=\"")
-			html.WriteString(escapeForHTML(strings.Join(parts[:i+1], "/")))
+			html.WriteString(escapeForAttribute(strings.Join(parts[:i+1], "/")))
 			html.WriteString("/\">")
 		}
 		html.WriteString(escapeForHTML(part))

Original file line number	Diff line number	Diff line change
`@@ -668,7 +668,7 @@ func respondWithDirList(queryPath string, dirEntries map[string]bool, fileEntrie`
`668`	`668`	`for i, part := range parts {`
`669`	`669`	`if i+1 < len(parts) {`
`670`	`670`	`html.WriteString("<a href=\"")`
`671`		`- html.WriteString(escapeForHTML(strings.Join(parts[:i+1], "/")))`
	`671`	`+ html.WriteString(escapeForAttribute(strings.Join(parts[:i+1], "/")))`
`672`	`672`	`html.WriteString("/\">")`
`673`	`673`	`}`
`674`	`674`	`html.WriteString(escapeForHTML(part))`