35404921100
40%

Ran 18 Sep 2026 11:15PM UTC

Jobs 0

Files 0

Run time –

Badge

Embed ▾

pending completion

cancel

Build # 35404921100

Build Type

push

github

Committed by

romshark

Commit Message

fix: Escape path values in URL sync scripts

Prevent `GET /shop/%27%2Balert(1)%2B%27/?q=x` from running
`alert(1)` through the generated `data-effect`. HTML escaping
turns the path quotes into `&#39;`, but the browser decodes them
before Datastar evaluates the expression.

Percent-encode path values before HTML escaping so quotes cannot
end the JavaScript string and URL delimiters remain in the segment.

Coverage Stats

Source Files on build 35404921100

Detailed source file information is not available for this build.

romshark / datapages / 35404921100
40%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on build 35404921100

romshark / datapages / 35404921100 40%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on build 35404921100

romshark / datapages / 35404921100
40%

README BADGES
x