#104 release/wiki/feed URLs lack percent-encoding
What
Generated URLs outside /files//raw still use HTML escaping but not URL path encoding:
src/releases.rs:426:/releases/{version}.htmlsrc/releases.rs:329: artifact paths (also the XSS finding)src/wiki.rs:292:/wiki/{path}.htmlsrc/feed.rs:102: release entry links
# and ? in repo-controlled names therefore become fragments/queries and link to the wrong file.
Reproduced
Fixture with release version v1#x and wiki file a#b.md:
<a href="/releases/v1#x.html">
<a href="/wiki/a#b.md.html">
Feed entry:
<link href="/releases/v1#x.html"/>
The output files contain literal #, but the links request v1 / a with a fragment.
Impact
Broken release, artifact, wiki, and feed links for valid repo names.
Fix
Reuse the encode_path/href_esc logic from #89 for release versions, wiki paths, artifact paths, and feed release links. Add a build test with #, ?, %, and spaces.
Uunknown ·
Fixed in PR #60 (
8e812dd, merged as67f5fb2) with regression coverage intests/review4_hardening.rsand the Pages inbox tests. f0rge CI run2026-10-27T18-19-28.378320411Zpassed.