https://gitlab.synchro.net/main/sbbs/-/commit/3957d2aee3c84479ae2339e1
Modified Files:
exec/webfileindex.ssjs
Log Message:
webfileindex: quote the interpolated URL attributes

Three attributes interpolated a filename into an unquoted value: the
file-view href, the download href, and the image src that view_image()
emits.

The view href was the worst of them, because its opening quote sat on the
wrong side of the ?view= token:

<a href=?view="somefile.zip" title='View'>

A parser reading an unquoted attribute value takes everything up to the
first whitespace, so href became ?view="somefile.zip" - quotes included -
which browsers then request as ?view=%22somefile.zip%22. Both forms
resolve to the same archive listing, so every viewable file had two working URLs and crawlers walked both: 14,067 of one day's 20,583 ?view= requests
on this host were the quoted duplicate.

The other two were merely unquoted. encodeURIComponent leaves ' unencoded,
and an apostrophe is not legal in an unquoted attribute value, so both
relied on parser leniency. There is a real instance here: JAIL'M.ZIP in Cyber.Xpo.95/GOVWATCH rendered as href=JAIL'M.ZIP. Of 1412 file
directories, 8 filenames contain a character encodeURIComponent leaves
alone that an unquoted attribute disallows, and one of those is viewable.

Spaces were never at risk in any of the three - encodeURIComponent had
already turned them into %20, so nothing terminated the value early - and
they still work; no URL that worked before stops working. Verified that the directory index still renders and that JAIL'M.ZIP both views and downloads.

One unquoted attribute is left alone deliberately: the static href=http://www.synchro.net in the footer interpolates nothing, so its value cannot vary.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net