---
id: b34ceec4-fcb1-4990-ac52-eaff51b04907
title: file paths in hrefs are not percent-encoded (# ? % break navigation)
state: closed
labels:
- ui
assignees: []
milestone: null
created: 2026-10-27T17:24:52.487219788Z
updated: 2026-10-27T17:45:41.755216504Z
---
## What

`href_esc` (`src/build.rs:407`) is only HTML escaping; file path segments are never percent-encoded. Git allows `#`, `?`, `%`, spaces and quotes in filenames.

- `a#b.txt` → `/files/a#b.txt.html` requests `/files/a` → 404
- `q?x.txt` → `/files/q?x.txt.html` requests `/files/q` → 404
- spaces happen to work because browsers encode them; `%` can be rejected as a bad escape by `serve`
- raw links, breadcrumb links and directory rows share the helper

## Reproduced

A fixture repo with `a#b.txt`, `a b.txt`, `q?x.txt`; navigation 404s for `#`/`?` while `/files/a%23b.txt.html` returns 200.

## Impact

A repo-controlled filename can make a file unreachable from the UI (or hide it from review); not XSS because `esc` still runs.

## Fix

Add a path-segment percent-encoder (`[A-Za-z0-9-._~]` plus `/`; everything else `%XX` UTF-8) and use it for hrefs only. Keep displayed text escaped. Test `#`, `?`, `%`, space, non-ASCII, quote.