LibWeb: Properly escape URL on error page

This commit is contained in:
Psychpsyo 2024-11-17 19:03:23 +01:00 committed by Andreas Kling
parent 634823d5b4
commit e8c228fb93
Notes: github-actions[bot] 2024-11-17 21:15:10 +00:00

View file

@ -33,7 +33,7 @@ ErrorOr<String> load_error_page(URL::URL const& url, StringView error_message)
auto template_file = TRY(Core::Resource::load_from_uri("resource://ladybird/templates/error.html"sv));
StringBuilder builder;
SourceGenerator generator { builder, '%', '%' };
generator.set("failed_url", url.to_byte_string());
generator.set("failed_url", escape_html_entities(url.to_byte_string()));
generator.set("error_message", escape_html_entities(error_message));
generator.append(template_file->data());
return TRY(String::from_utf8(generator.as_string_view()));