fix: (regression beta) possible security problem with "basic" interface
Massimo Melina committed
Oct 10, 2024 at 17:12 UTC
ff8a9e959616e5c5e14aa134c6b5424b7c9731fd
1 file changed
+1
-1
src/cross.ts
+1
-1
@@ -401,7 +401,7 @@ export async function promiseBestEffort<T>(promises: Promise<T>[]) {
401
402
// encode paths leaving / separator unencoded (not like encodeURIComponent), but still encode #
403
export function pathEncode(s: string) {
404
- return s.replace(/[#'"% ?\\]/g, encodeURIComponent)
404
+ return s.replace(/[:&#'"% ?\\]/g, encodeURIComponent)
405
}
406
//unused function pathDecode(s: string) { return decodeURI(s).replace(/%23/g, '#') }
407