---

id: 983bd144-65ee-436f-a783-d80072c63ec5 title: release/wiki/feed URLs lack percent-encoding state: closed labels:

• area:release assignees: [] milestone: null created: 2026-10-27T18:08:32.940173587Z updated: 2026-10-27T18:20:51.896193721Z

---

What

Generated URLs outside /files//raw still use HTML escaping but not URL path encoding:

• src/releases.rs:426: /releases/{version}.html
• src/releases.rs:329: artifact paths (also the XSS finding)
• src/wiki.rs:292: /wiki/{path}.html
• src/feed.rs:102: release entry links

# and ? in repo-controlled names therefore become fragments/queries and link to the wrong file.

Reproduced

Fixture with release version v1#x and wiki file a#b.md:

<a href="/releases/v1#x.html">
<a href="/wiki/a#b.md.html">

Feed entry:

<link href="/releases/v1#x.html"/>

The output files contain literal #, but the links request v1 / a with a fragment.

Impact

Broken release, artifact, wiki, and feed links for valid repo names.

Fix

Reuse the encode_path/href_esc logic from #89 for release versions, wiki paths, artifact paths, and feed release links. Add a build test with #, ?, %, and spaces.