瀏覽代碼

LibWeb: Properly escape URL on error page

Psychpsyo 8 月之前
父節點
當前提交
e8c228fb93
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      Libraries/LibWeb/Loader/GeneratedPagesLoader.cpp

+ 1 - 1
Libraries/LibWeb/Loader/GeneratedPagesLoader.cpp

@@ -33,7 +33,7 @@ ErrorOr<String> load_error_page(URL::URL const& url, StringView error_message)
     auto template_file = TRY(Core::Resource::load_from_uri("resource://ladybird/templates/error.html"sv));
     StringBuilder builder;
     SourceGenerator generator { builder, '%', '%' };
-    generator.set("failed_url", url.to_byte_string());
+    generator.set("failed_url", escape_html_entities(url.to_byte_string()));
     generator.set("error_message", escape_html_entities(error_message));
     generator.append(template_file->data());
     return TRY(String::from_utf8(generator.as_string_view()));