---
id: 983bd144-65ee-436f-a783-d80072c63ec5
title: release/wiki/feed URLs lack percent-encoding
state: closed
labels:
- area:release
assignees: []
milestone: null
created: 2026-10-27T18:08:32.940173587Z
updated: 2026-10-27T18:20:51.896193721Z
---
## What

Generated URLs outside `/files`/`/raw` still use HTML escaping but not URL path encoding:

- `src/releases.rs:426`: `/releases/{version}.html`
- `src/releases.rs:329`: artifact paths (also the XSS finding)
- `src/wiki.rs:292`: `/wiki/{path}.html`
- `src/feed.rs:102`: release entry links

`#` and `?` in repo-controlled names therefore become fragments/queries and link to the wrong file.

## Reproduced

Fixture with release version `v1#x` and wiki file `a#b.md`:

```html
<a href="/releases/v1#x.html">
<a href="/wiki/a#b.md.html">
```

Feed entry:

```xml
<link href="/releases/v1#x.html"/>
```

The output files contain literal `#`, but the links request `v1` / `a` with a fragment.

## Impact

Broken release, artifact, wiki, and feed links for valid repo names.

## Fix

Reuse the `encode_path`/`href_esc` logic from #89 for release versions, wiki paths, artifact paths, and feed release links. Add a build test with `#`, `?`, `%`, and spaces.