Sanitize URL on navigation change

beackers · web-flow · commit 91a0575e070e · 2025-12-11T15:43:23.000-06:00
Escape special characters in the URL before redirection.
Hopefully this works. This was according to Copilot by Microsoft.
diff --git a/static/nav.js b/static/nav.js
@@ -48,7 +48,7 @@ function addANav() {
 
     sel.addEventListener("change", () => {
         if (sel.value !== current && acceptablePaths.includes(window.location.pathname)) {
-            window.location.href = sel.value;
+            window.location.href = sel.value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         }
     });
 

Original file line number	Diff line number	Diff line change
`@@ -48,7 +48,7 @@ function addANav() {`
`48`	`48`
`49`	`49`	`sel.addEventListener("change", () => {`
`50`	`50`	`if (sel.value !== current && acceptablePaths.includes(window.location.pathname)) {`
`51`		`- window.location.href = sel.value;`
	`51`	`+ window.location.href = sel.value.replace(/[.*+?^${}()\|[\]\\]/g, '\\$&');`
`52`	`52`	`}`
`53`	`53`	`});`
`54`	`54`