fix(utils): escape percent signs in placeholder replacements (#2736)

Author: BerniSc

lua/codecompanion/utils/init.lua

@@ -108,14 +108,20 @@ function M.extract_all_placeholders(prompts)
   return all_placeholders
 end
 
+---@param str string The string to escape percent signs in for gsub replacement
+---@return string The escaped string, safe for use as a gsub replacement
+local function escape_gsub_replacement(str)
+  return (str:gsub("%%", "%%%%"))
+end
+
 ---Replace any placeholders (e.g. ${placeholder}) in a string or table
 ---@param t table|string The content to process
 ---@param replacements table<string, string> Map of placeholder names to replacement values
 ---@return string|nil The replaced string if input was string, or nil if input was table (modified in place)
 function M.replace_placeholders(t, replacements)
   if type(t) == "string" then
     for placeholder, replacement in pairs(replacements) do
-      t = t:gsub("%${" .. vim.pesc(placeholder) .. "}", replacement)
+      t = t:gsub("%${" .. vim.pesc(placeholder) .. "}", escape_gsub_replacement(replacement))
     end
     return t
   else
@@ -124,7 +130,7 @@ function M.replace_placeholders(t, replacements)
         M.replace_placeholders(value, replacements)
       elseif type(value) == "string" then
         for placeholder, replacement in pairs(replacements) do
-          value = value:gsub("%${" .. vim.pesc(placeholder) .. "}", replacement)
+          value = value:gsub("%${" .. vim.pesc(placeholder) .. "}", escape_gsub_replacement(replacement))
         end
         t[key] = value
       end

tests/utils/test_utils.lua

@@ -200,6 +200,26 @@ T["Utils"]["replace_placeholders()"]["handles special characters in placeholder
   h.eq(result, "Value: test")
 end
 
+T["Utils"]["replace_placeholders()"]["handles percent signs in replacement values"] = function()
+  local result = child.lua([[
+    return utils.replace_placeholders(
+      '(<a href="https://my.test.page/tester.php?login=${email}" title="Test Page">%20</a>)',
+      { email = "testuser%40testing.org" }
+    )
+  ]])
+  h.eq(result, '(<a href="https://my.test.page/tester.php?login=testuser%40testing.org" title="Test Page">%20</a>)')
+end
+
+T["Utils"]["replace_placeholders()"]["handles simple percent signs in replacement"] = function()
+  local result = child.lua([[
+    return utils.replace_placeholders(
+      "Encoded: ${value}",
+      { value = "%20" }
+    )
+  ]])
+  h.eq(result, "Encoded: %20")
+end
+
 T["Utils"]["resolve_nested_value()"] = MiniTest.new_set()
 
 T["Utils"]["resolve_nested_value()"]["resolves top-level value"] = function()