From e9496467904e13c3f954927be6c59aab5f19229b Mon Sep 17 00:00:00 2001
From: towalink <62961054+towalink@users.noreply.github.com>
Date: Sun, 11 Jun 2023 00:14:10 +0200
Subject: [PATCH] Properly escape URL path (#81)

---
 frontend/assets/templates/page.tpl | 2 +-
 frontend/template.go               | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/frontend/assets/templates/page.tpl b/frontend/assets/templates/page.tpl
index d8bd1a0..94d1ccf 100644
--- a/frontend/assets/templates/page.tpl
+++ b/frontend/assets/templates/page.tpl
@@ -60,7 +60,7 @@
 					<option value="{{ html $k }}"{{ if eq $k $.URLOption }} selected{{end}}>{{ html $v }}</option>
 					{{ end }}
 				</select>
-				<input name="server" class="d-none" value="{{ html $server }}">
+				<input name="server" class="d-none" value="{{ html ($server | pathescape) }}">
 				<input name="target" class="form-control" placeholder="Target" aria-label="Target" value="{{ html $target }}">
 				<div class="input-group-append">
 					<button class="btn btn-outline-success" type="submit">&raquo;</button>
diff --git a/frontend/template.go b/frontend/template.go
index 2f993f6..d735d46 100644
--- a/frontend/template.go
+++ b/frontend/template.go
@@ -3,6 +3,7 @@ package main
 import (
 	"embed"
 	"html/template"
+        "net/url"
 	"strings"
 )
 
@@ -104,6 +105,12 @@ var requiredTemplates = [...]string{
 	"bird",
 }
 
+// define functions to be made available in templates
+
+var funcMap = template.FuncMap{
+        "pathescape": url.PathEscape,
+}
+
 // import templates from embedded assets
 
 func ImportTemplates() {
@@ -121,7 +128,7 @@ func ImportTemplates() {
 		}
 
 		// and add it to the template library
-		template, err := template.New(tmpl).Parse(string(def))
+		template, err := template.New(tmpl).Funcs(funcMap).Parse(string(def))
 		if err != nil {
 			panic("Unable to parse template (" + TEMPLATE_PATH + tmpl + ": " + err.Error())
 		}