[bskylink] URL-encode apostrophes before HTML escaping (#9559)

2026-03-16 18:18:23 +00:00
parent 2027589c55
commit 177bdcd2b7
1 changed files with 11 additions and 1 deletions
@@ -1,10 +1,20 @@
 import escapeHTML from 'escape-html'

 export function linkRedirectContents(link: string): string {
+  // Encode characters that could break out of the single-quoted URL in meta refresh.
+  // HTML entity escaping (&#39;) is insufficient because the browser decodes entities
+  // before the meta refresh parser processes the URL, allowing apostrophes to
+  // prematurely terminate the URL string.
+  //
+  // Example: "They're" with HTML escaping becomes "They&#39;re" in HTML, but after
+  // the browser decodes the content attribute, the meta refresh parser sees "They're"
+  // and interprets the apostrophe as the closing quote, truncating the URL to "They".
+  const safeLink = link.replace(/'/g, '%27')
+
  return `
    <html>
      <head>
-        <meta http-equiv="refresh" content="0; URL='${escapeHTML(link)}'" />
+        <meta http-equiv="refresh" content="0; URL='${escapeHTML(safeLink)}'" />
        <meta
          http-equiv="Cache-Control"
          content="no-store, no-cache, must-revalidate, max-age=0" />