TK-11535: encode sort in pager() href — close the unescaped-attribute injection (matches q)

35ab401a55536505d0243e2492e6a2ee4c06355e · 2026-09-12 07:20:29 -0700 · Steve Abrams

Files touched

M shared/render.js

Diff

commit 35ab401a55536505d0243e2492e6a2ee4c06355e
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat Sep 12 07:20:29 2026 -0700

    TK-11535: encode sort in pager() href — close the unescaped-attribute injection (matches q)
---
 shared/render.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shared/render.js b/shared/render.js
index c4d2f36..73b4a49 100644
--- a/shared/render.js
+++ b/shared/render.js
@@ -809,7 +809,7 @@ ${script(cfg)}
 }
 
 function pager(q,sort,page,pages){
-  const link=(p)=>`/catalog?q=${encodeURIComponent(q)}&sort=${sort}&page=${p}`;
+  const link=(p)=>`/catalog?q=${encodeURIComponent(q)}&sort=${encodeURIComponent(sort)}&page=${p}`;
   let html='<div style="display:flex;gap:8px;justify-content:center;padding:10px 0 50px;flex-wrap:wrap">';
   const lo=Math.max(1,page-3),hi=Math.min(pages,page+3);
   if(page>1)html+=`<a class="hero-cta__btn" style="position:static;padding:9px 16px" href="${link(page-1)}">Prev</a>`;

← b757902 test(catalog): keep the TK-11470 sort proof harness in-repo · back to Dw Domain Fleet · chore: v1.0.2 (TK-11470 session close) cbc272c →