From 5078b3ec0743756bdfd4fc6c4cc4b558d554dd6e Mon Sep 17 00:00:00 2001
From: Daniel Kempkens <daniel+git@kempkens.io>
Date: Thu, 18 May 2023 12:52:47 +0200
Subject: [PATCH] fix: Escape href and src URIs

---
 priv/templates/http/post.eex            | 4 ++--
 priv/templates/http/subreddit_posts.eex | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/priv/templates/http/post.eex b/priv/templates/http/post.eex
index 65611ab..87d0518 100644
--- a/priv/templates/http/post.eex
+++ b/priv/templates/http/post.eex
@@ -27,7 +27,7 @@
           <div class="carousel-inner">
             <%= for {img, i} <-  Enum.with_index(media.images) do %>
               <div class="carousel-item <%= if i == 0, do: "active" %>">
-                <img src="<%= img %>" class="d-block w-100">
+                <img src="<%= URI.encode(img) %>" class="d-block w-100">
               </div>
             <% end %>
           </div>
@@ -48,7 +48,7 @@
         <div class="row">
           <%= for video <-  media.videos do %>
             <video controls>
-              <source src="<%= video %>" type="video/mp4">
+              <source src="<%= URI.encode(video) %>" type="video/mp4">
             </video>
           <% end %>
         </div>
diff --git a/priv/templates/http/subreddit_posts.eex b/priv/templates/http/subreddit_posts.eex
index e94be50..77a1d33 100644
--- a/priv/templates/http/subreddit_posts.eex
+++ b/priv/templates/http/subreddit_posts.eex
@@ -19,7 +19,7 @@
           <%= for post <- posts do %>
             <div class="card">
               <div class="card-body">
-                <h5 class="card-title"><a href="/r/<%= subreddit %>/<%= date %>/<%= post.filename %>"><%= post.title %></a></h5>
+                <h5 class="card-title"><a href="/r/<%= subreddit %>/<%= date %>/<%= URI.encode(post.filename) %>"><%= post.title %></a></h5>
                 <h6 class="card-subtitle mb-2 text-body-secondary">
                   <%= post.num_comments %> comment(s) - <%= trunc(post.created_utc) |> DateTime.from_unix!() |> DateTime.to_iso8601() %>
                 </h6>