fix: (regression beta) possible security problem with "basic" interface

rejetto · Oct 10, 2024 · ff8a9e9 · ff8a9e9
1 parent 06c5ee9
commit ff8a9e9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/cross.ts b/src/cross.ts
@@ -401,7 +401,7 @@ export async function promiseBestEffort<T>(promises: Promise<T>[]) {
 
 // encode paths leaving / separator unencoded (not like encodeURIComponent), but still encode #
 export function pathEncode(s: string) {
-    return s.replace(/[#'"% ?\\]/g, encodeURIComponent)
+    return s.replace(/[:&#'"% ?\\]/g, encodeURIComponent)
 }
 //unused function pathDecode(s: string) { return decodeURI(s).replace(/%23/g, '#') }