fix: DOM text reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
PDOK · Jan 6, 2025 · 6b149e4 · 6b149e4
1 parent ba9a0f2
commit 6b149e4
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/internal/ogc/styles/templates/styles.go.html b/internal/ogc/styles/templates/styles.go.html
@@ -99,13 +99,13 @@ <h1 class="title" id="title">{{ .Config.Title }} - {{ i18n "Styles" }}</h1>
       const selectedProjection = value.proj;
       const urlHref = document.getElementById('href-url');
       const metadataHref = document.getElementById('href-metadata');
-      urlHref.textContent = '{{ $baseUrl }}/styles/' + selectedStyle;
-      urlHref.setAttribute('href', 'styles/' + selectedStyle);
-      metadataHref.setAttribute('href', 'styles/' + selectedStyle + '/metadata');
+      urlHref.textContent = '{{ $baseUrl }}/styles/' + encodeURIComponent(selectedStyle);
+      urlHref.setAttribute('href', 'styles/' + encodeURIComponent(selectedStyle));
+      metadataHref.setAttribute('href', 'styles/' + encodeURIComponent(selectedStyle) + '/metadata');
       // update style-url in app-vectortile-view
       const viewer = document.getElementById('styles-vectortile-view')
-      viewer.setAttribute('tile-url', '{{ $baseUrl }}/tiles/' + selectedProjection)
-      viewer.setAttribute('style-url', '{{ $baseUrl }}/styles/' + selectedStyle + '?f=mapbox')
+      viewer.setAttribute('tile-url', '{{ $baseUrl }}/tiles/' + encodeURIComponent(selectedProjection))
+      viewer.setAttribute('style-url', '{{ $baseUrl }}/styles/' + encodeURIComponent(selectedStyle) + '?f=mapbox')
     }, false);
   </script>
   <noscript>Enable Javascript to display vector tiles viewer</noscript>