From 177bdcd2b7807c9980dab32e7a5664fc006df40b Mon Sep 17 00:00:00 2001
From: surfdude29 <149612116+surfdude29@users.noreply.github.com>
Date: Mon, 16 Mar 2026 18:18:23 +0000
Subject: [PATCH] [bskylink] URL-encode apostrophes before HTML escaping
(#9559)
---
bskylink/src/html/linkRedirectContents.ts | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/bskylink/src/html/linkRedirectContents.ts b/bskylink/src/html/linkRedirectContents.ts
index f1bcdbb91e..bc87aef9de 100644
--- a/bskylink/src/html/linkRedirectContents.ts
+++ b/bskylink/src/html/linkRedirectContents.ts
@@ -1,10 +1,20 @@
import escapeHTML from 'escape-html'
export function linkRedirectContents(link: string): string {
+ // Encode characters that could break out of the single-quoted URL in meta refresh.
+ // HTML entity escaping (') is insufficient because the browser decodes entities
+ // before the meta refresh parser processes the URL, allowing apostrophes to
+ // prematurely terminate the URL string.
+ //
+ // Example: "They're" with HTML escaping becomes "They're" in HTML, but after
+ // the browser decodes the content attribute, the meta refresh parser sees "They're"
+ // and interprets the apostrophe as the closing quote, truncating the URL to "They".
+ const safeLink = link.replace(/'/g, '%27')
+
return `
-
+