From 20516e10465f18334c0ea805104d4842301c0550 Mon Sep 17 00:00:00 2001
From: smthbh <smthbh@gmail.com>
Date: Mon, 28 Apr 2025 20:38:19 -0400
Subject: [PATCH] fix possible security issue

---
 static/character-quests-compare.hbs | 4 +++-
 static/character-quests.hbs         | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/static/character-quests-compare.hbs b/static/character-quests-compare.hbs
index 3439e47..cec7caa 100644
--- a/static/character-quests-compare.hbs
+++ b/static/character-quests-compare.hbs
@@ -120,7 +120,9 @@ document.addEventListener('DOMContentLoaded', function() {
             const [realm, name] = selected.split('/');
             // Get the base path by removing everything after /quests/compare/
             const basePath = window.location.pathname.split('/quests/compare/')[0];
-            window.location.href = `${basePath}/quests/compare/${realm}/${name}`;
+            const safeRealm = encodeURIComponent(realm);
+            const safeName = encodeURIComponent(name);
+            window.location.href = `${basePath}/quests/compare/${safeRealm}/${safeName}`;
         }
     });
 });
diff --git a/static/character-quests.hbs b/static/character-quests.hbs
index 920c6b8..f6a85cf 100644
--- a/static/character-quests.hbs
+++ b/static/character-quests.hbs
@@ -132,7 +132,9 @@ document.addEventListener('DOMContentLoaded', function() {
         const selected = compareSelect.value;
         if (selected) {
             const [realm, name] = selected.split('/');
-            window.location.href = `${window.location.pathname}/compare/${realm}/${name}`;
+            const sanitizedRealm = encodeURIComponent(realm);
+            const sanitizedName = encodeURIComponent(name);
+            window.location.href = `${window.location.pathname}/compare/${sanitizedRealm}/${sanitizedName}`;
         }
     });
 });