From f5e7599749ce47b2a65d172497c94851509b32dd Mon Sep 17 00:00:00 2001
From: simon chrzanowski <simonch@gmx.de>
Date: Wed, 14 Oct 2026 08:37:40 +0200
Subject: [PATCH] Stop interpolating archive paths into inline handlers

The source browser built its file tree with onclick handlers such as
loadFile('${escapeHTML(file.path)}'). The browser decodes HTML entities in
an attribute before running the handler, so the &#39; that escapeHTML
produces turns back into a quote and ends the string. A cached package
with a crafted file name ran script on the proxy origin for anyone who
browsed it.

- Carry the path in data-path and dispatch clicks from one delegated
  listener on the file tree
- Render the binary download button as a link instead of an onclick
  that assigns window.location
- Fail the template tests when an inline handler interpolates data
---
 .../server/templates/pages/browse_source.html | 27 ++++++++++++----
 internal/server/templates_handlers_test.go    | 32 +++++++++++++++++++
 2 files changed, 53 insertions(+), 6 deletions(-)
 create mode 100644 internal/server/templates_handlers_test.go

diff --git a/internal/server/templates/pages/browse_source.html b/internal/server/templates/pages/browse_source.html
index a949111a..0d5332a2 100644
--- a/internal/server/templates/pages/browse_source.html
+++ b/internal/server/templates/pages/browse_source.html
@@ -104,7 +104,7 @@ <h2 class="font-semibold font-mono text-sm" id="file-path">Select a file</h2>
         const parentPath = basePath.split('/').slice(0, -2).join('/');
         html += `
             <div class="px-2 py-1 hover:bg-gray-100 dark:hover:bg-gray-800 rounded cursor-pointer text-sm flex items-center gap-2 text-gray-500 dark:text-gray-400"
-                 onclick="loadFileTree('${escapeHTML(parentPath)}'); currentPath='${escapeHTML(parentPath)}';">
+                 data-action="open-dir" data-path="${escapeHTML(parentPath)}">
                 <i data-lucide="corner-left-up" class="w-4 h-4 shrink-0"></i><span>..</span>
             </div>
         `;
@@ -119,13 +119,13 @@ <h2 class="font-semibold font-mono text-sm" id="file-path">Select a file</h2>
 
         if (file.is_dir) {
             html += `
-                <div class="${classes}" onclick="loadFileTree('${escapeHTML(file.path)}'); currentPath='${escapeHTML(file.path)}';">
+                <div class="${classes}" data-action="open-dir" data-path="${escapeHTML(file.path)}">
                     ${iconHTML}<span class="truncate">${escapeHTML(file.name)}</span>
                 </div>
             `;
         } else {
             html += `
-                <div class="${classes}" onclick="loadFile('${escapeHTML(file.path)}')">
+                <div class="${classes}" data-action="open-file" data-path="${escapeHTML(file.path)}">
                     ${iconHTML}<span class="truncate">${escapeHTML(file.name)}</span>
                     <span class="text-xs text-gray-500 dark:text-gray-400 ml-auto shrink-0">${formatSize(file.size)}</span>
                 </div>
@@ -179,10 +179,10 @@ <h2 class="font-semibold font-mono text-sm" id="file-path">Select a file</h2>
             container.innerHTML = `
                 <div class="text-center text-gray-500 dark:text-gray-400 py-8">
                     <p class="mb-4">Binary file (${formatSize(content.length)})</p>
-                    <button onclick="window.location.href='${escapeHTML(url)}'"
-                            class="px-4 py-2 bg-blue-600 text-white rounded hover:bg-blue-700">
+                    <a href="${escapeHTML(url)}"
+                       class="inline-block px-4 py-2 bg-blue-600 text-white rounded hover:bg-blue-700">
                         Download
-                    </button>
+                    </a>
                 </div>
             `;
         }
@@ -207,6 +207,21 @@ <h2 class="font-semibold font-mono text-sm" id="file-path">Select a file</h2>
     return (bytes / (1024 * 1024)).toFixed(1) + ' MB';
 }
 
+// Entries carry their path in data-path rather than in inline handlers: the
+// browser decodes entities in a handler attribute before running it, so an
+// escaped quote in a file name would end the handler's string.
+document.getElementById('file-tree').addEventListener('click', (event) => {
+    const entry = event.target.closest('[data-action]');
+    if (!entry) return;
+    const path = entry.dataset.path;
+    if (entry.dataset.action === 'open-dir') {
+        loadFileTree(path);
+        currentPath = path;
+    } else if (entry.dataset.action === 'open-file') {
+        loadFile(path);
+    }
+});
+
 // Load root directory on page load
 loadFileTree();
 </script>
diff --git a/internal/server/templates_handlers_test.go b/internal/server/templates_handlers_test.go
new file mode 100644
index 00000000..1e3f1f21
--- /dev/null
+++ b/internal/server/templates_handlers_test.go
@@ -0,0 +1,32 @@
+package server
+
+import (
+	"io/fs"
+	"regexp"
+	"testing"
+)
+
+// inlineHandlerWithData matches an inline event handler attribute whose value
+// interpolates a JavaScript template expression. The browser decodes HTML
+// entities in the attribute before running the handler, so escapeHTML cannot
+// keep a quote in the interpolated value from ending the handler's string.
+var inlineHandlerWithData = regexp.MustCompile(`\son[a-z]+\s*=\s*"[^"]*\$\{`)
+
+func TestTemplatesInterpolateNoDataIntoInlineHandlers(t *testing.T) {
+	err := fs.WalkDir(templatesFS, "templates", func(path string, d fs.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return err
+		}
+		source, err := fs.ReadFile(templatesFS, path)
+		if err != nil {
+			return err
+		}
+		for _, match := range inlineHandlerWithData.FindAll(source, -1) {
+			t.Errorf("%s: inline handler interpolates data: %s", path, match)
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+}