From 0947c266122a49e8452e9a3efb978a1e38048868 Mon Sep 17 00:00:00 2001
From: mastihios <91783447+mastihios@users.noreply.github.com>
Date: Mon, 11 Oct 2021 12:18:20 +0000
Subject: [PATCH] Fix URL-encoding in href strings (#2460)

* hrefs: replace HTML.escape w/ URI.encode_www_form

* Fix search_query_encoded
---
 src/invidious/views/add_playlist_items.ecr |  4 ++--
 src/invidious/views/channel.ecr            |  4 ++--
 src/invidious/views/components/item.ecr    |  4 ++--
 src/invidious/views/playlists.ecr          |  2 +-
 src/invidious/views/search.ecr             | 14 +++++++-------
 5 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/src/invidious/views/add_playlist_items.ecr b/src/invidious/views/add_playlist_items.ecr
index 09eacbc8..c62861b0 100644
--- a/src/invidious/views/add_playlist_items.ecr
+++ b/src/invidious/views/add_playlist_items.ecr
@@ -41,7 +41,7 @@
     <div class="pure-g h-box">
         <div class="pure-u-1 pure-u-lg-1-5">
             <% if page > 1 %>
-                <a href="/add_playlist_items?list=<%= plid %>&q=<%= HTML.escape(query.not_nil!) %>&page=<%= page - 1 %>">
+                <a href="/add_playlist_items?list=<%= plid %>&q=<%= URI.encode_www_form(query.not_nil!) %>&page=<%= page - 1 %>">
                     <%= translate(locale, "Previous page") %>
                 </a>
             <% end %>
@@ -49,7 +49,7 @@
         <div class="pure-u-1 pure-u-lg-3-5"></div>
         <div class="pure-u-1 pure-u-lg-1-5" style="text-align:right">
             <% if count >= 20 %>
-                <a href="/add_playlist_items?list=<%= plid %>&q=<%= HTML.escape(query.not_nil!) %>&page=<%= page + 1 %>">
+                <a href="/add_playlist_items?list=<%= plid %>&q=<%= URI.encode_www_form(query.not_nil!) %>&page=<%= page + 1 %>">
                     <%= translate(locale, "Next page") %>
                 </a>
             <% end %>
diff --git a/src/invidious/views/channel.ecr b/src/invidious/views/channel.ecr
index 09cfb76e..7f797e37 100644
--- a/src/invidious/views/channel.ecr
+++ b/src/invidious/views/channel.ecr
@@ -96,7 +96,7 @@
 <div class="pure-g h-box">
     <div class="pure-u-1 pure-u-lg-1-5">
         <% if page > 1 %>
-            <a href="/channel/<%= ucid %>?page=<%= page - 1 %><% if sort_by != "newest" %>&sort_by=<%= HTML.escape(sort_by) %><% end %>">
+            <a href="/channel/<%= ucid %>?page=<%= page - 1 %><% if sort_by != "newest" %>&sort_by=<%= URI.encode_www_form(sort_by) %><% end %>">
                 <%= translate(locale, "Previous page") %>
             </a>
         <% end %>
@@ -104,7 +104,7 @@
     <div class="pure-u-1 pure-u-lg-3-5"></div>
     <div class="pure-u-1 pure-u-lg-1-5" style="text-align:right">
         <% if count == 60 %>
-            <a href="/channel/<%= ucid %>?page=<%= page + 1 %><% if sort_by != "newest" %>&sort_by=<%= HTML.escape(sort_by) %><% end %>">
+            <a href="/channel/<%= ucid %>?page=<%= page + 1 %><% if sort_by != "newest" %>&sort_by=<%= URI.encode_www_form(sort_by) %><% end %>">
                 <%= translate(locale, "Next page") %>
             </a>
         <% end %>
diff --git a/src/invidious/views/components/item.ecr b/src/invidious/views/components/item.ecr
index 84da1091..b15ae255 100644
--- a/src/invidious/views/components/item.ecr
+++ b/src/invidious/views/components/item.ecr
@@ -87,7 +87,7 @@
                         <a title="<%=translate(locale, "Audio mode")%>" href="/watch?v=<%= item.id %>&list=<%= item.plid %>&amp;listen=1">
                             <i class="icon ion-md-headset"></i>
                         </a>
-                        <a title="<%=translate(locale, "Switch Invidious Instance")%>" href="/redirect?referer=<%=HTML.escape("watch?v=#{item.id}&list=#{item.plid}")%>">
+                        <a title="<%=translate(locale, "Switch Invidious Instance")%>" href="/redirect?referer=<%=URI.encode_www_form("watch?v=#{item.id}&list=#{item.plid}")%>">
                             <i class="icon ion-md-jet"></i>
                         </a>
                     </div>
@@ -163,7 +163,7 @@
                         <a title="<%=translate(locale, "Audio mode")%>" href="/watch?v=<%= item.id %>&amp;listen=1">
                             <i class="icon ion-md-headset"></i>
                         </a>
-                        <a title="<%=translate(locale, "Switch Invidious Instance")%>" href="/redirect?referer=<%=HTML.escape("watch?v=#{item.id}")%>">
+                        <a title="<%=translate(locale, "Switch Invidious Instance")%>" href="/redirect?referer=<%=URI.encode_www_form("watch?v=#{item.id}")%>">
                             <i class="icon ion-md-jet"></i>
                         </a>
                     </div>
diff --git a/src/invidious/views/playlists.ecr b/src/invidious/views/playlists.ecr
index d9a17a9b..1245256f 100644
--- a/src/invidious/views/playlists.ecr
+++ b/src/invidious/views/playlists.ecr
@@ -96,7 +96,7 @@
     <div class="pure-u-1 pure-u-md-4-5"></div>
     <div class="pure-u-1 pure-u-lg-1-5" style="text-align:right">
         <% if continuation %>
-            <a href="/channel/<%= ucid %>/playlists?continuation=<%= continuation %><% if sort_by != "last" %>&sort_by=<%= HTML.escape(sort_by) %><% end %>">
+            <a href="/channel/<%= ucid %>/playlists?continuation=<%= continuation %><% if sort_by != "last" %>&sort_by=<%= URI.encode_www_form(sort_by) %><% end %>">
                 <%= translate(locale, "Next page") %>
             </a>
         <% end %>
diff --git a/src/invidious/views/search.ecr b/src/invidious/views/search.ecr
index fd176e41..db374548 100644
--- a/src/invidious/views/search.ecr
+++ b/src/invidious/views/search.ecr
@@ -2,7 +2,7 @@
 <title><%= search_query.not_nil!.size > 30 ? HTML.escape(query.not_nil![0,30].rstrip(".") + "...") : HTML.escape(query.not_nil!) %> - Invidious</title>
 <% end %>
 
-<% search_query_encoded = env.get?("search").try { |x| URI.encode(x.as(String), space_to_plus: true) } %>
+<% search_query_encoded = env.get?("search").try { |x| URI.encode_www_form(x.as(String), space_to_plus: true) } %>
 
 <!-- Search redirection and filtering UI -->
 <% if count == 0 %>
@@ -23,7 +23,7 @@
                         <% if operator_hash.fetch("date", "all") == date %>
                             <b><%= translate(locale, date) %></b>
                         <% else %>
-                            <a href="/search?q=<%= HTML.escape(query.not_nil!.gsub(/ ?date:[a-z]+/, "") + " date:" + date) %>&page=<%= page %>">
+                            <a href="/search?q=<%= URI.encode_www_form(query.not_nil!.gsub(/ ?date:[a-z]+/, "") + " date:" + date) %>&page=<%= page %>">
                                 <%= translate(locale, date) %>
                             </a>
                         <% end %>
@@ -38,7 +38,7 @@
                         <% if operator_hash.fetch("content_type", "all") == content_type %>
                             <b><%= translate(locale, content_type) %></b>
                         <% else %>
-                            <a href="/search?q=<%= HTML.escape(query.not_nil!.gsub(/ ?content_type:[a-z]+/, "") + " content_type:" + content_type) %>&page=<%= page %>">
+                            <a href="/search?q=<%= URI.encode_www_form(query.not_nil!.gsub(/ ?content_type:[a-z]+/, "") + " content_type:" + content_type) %>&page=<%= page %>">
                                 <%= translate(locale, content_type) %>
                             </a>
                         <% end %>
@@ -53,7 +53,7 @@
                         <% if operator_hash.fetch("duration", "all") == duration %>
                             <b><%= translate(locale, duration) %></b>
                         <% else %>
-                            <a href="/search?q=<%= HTML.escape(query.not_nil!.gsub(/ ?duration:[a-z]+/, "") + " duration:" + duration) %>&page=<%= page %>">
+                            <a href="/search?q=<%= URI.encode_www_form(query.not_nil!.gsub(/ ?duration:[a-z]+/, "") + " duration:" + duration) %>&page=<%= page %>">
                                 <%= translate(locale, duration) %>
                             </a>
                         <% end %>
@@ -68,11 +68,11 @@
                         <% if operator_hash.fetch("features", "all").includes?(feature) %>
                             <b><%= translate(locale, feature) %></b>
                         <% elsif operator_hash.has_key?("features") %>
-                            <a href="/search?q=<%= HTML.escape(query.not_nil!.gsub(/features:/, "features:" + feature + ",")) %>&page=<%= page %>">
+                            <a href="/search?q=<%= URI.encode_www_form(query.not_nil!.gsub(/features:/, "features:" + feature + ",")) %>&page=<%= page %>">
                                 <%= translate(locale, feature) %>
                             </a>
                         <% else %>
-                            <a href="/search?q=<%= HTML.escape(query.not_nil! + " features:" + feature) %>&page=<%= page %>">
+                            <a href="/search?q=<%= URI.encode_www_form(query.not_nil! + " features:" + feature) %>&page=<%= page %>">
                                 <%= translate(locale, feature) %>
                             </a>
                         <% end %>
@@ -87,7 +87,7 @@
                         <% if operator_hash.fetch("sort", "relevance") == sort %>
                             <b><%= translate(locale, sort) %></b>
                         <% else %>
-                            <a href="/search?q=<%= HTML.escape(query.not_nil!.gsub(/ ?sort:[a-z]+/, "") + " sort:" + sort) %>&page=<%= page %>">
+                            <a href="/search?q=<%= URI.encode_www_form(query.not_nil!.gsub(/ ?sort:[a-z]+/, "") + " sort:" + sort) %>&page=<%= page %>">
                                 <%= translate(locale, sort) %>
                             </a>
                         <% end %>