encode/decode URIs in html.tag('a') & live-dev-server

Fixes #147.

2 files changed, 17 insertions, 1 deletions

diff --git a/src/util/html.js b/src/util/html.js
index a6b0d621..459a1647 100644
--- a/src/util/html.js
+++ b/src/util/html.js
@@ -130,6 +130,14 @@ export function attributes(attribs) {
         throw new Error(`Attribute value for ${key} should be primitive or array, got ${typeof val}`);
     })
     .filter(([_key, _val, keep]) => keep)
+    .map(([key, val]) => {
+      switch (key) {
+        case 'href':
+          return [key, encodeURI(val)];
+        default:
+          return [key, val];
+      }
+    })
     .map(([key, val]) =>
       typeof val === 'boolean'
         ? `${key}`
diff --git a/src/write/build-modes/live-dev-server.js b/src/write/build-modes/live-dev-server.js
index 39229a9a..a8fd3705 100644
--- a/src/write/build-modes/live-dev-server.js
+++ b/src/write/build-modes/live-dev-server.js
@@ -163,7 +163,15 @@ export async function go({
         localDirectory = mediaPath;
       }
 
-      const filePath = path.resolve(localDirectory, safePath.split('/').join(path.sep));
+      let filePath;
+      try {
+        filePath = path.resolve(localDirectory, decodeURI(safePath.split('/').join(path.sep)));
+      } catch (error) {
+        response.writeHead(404, contentTypePlain);
+        response.end(`No ${localFileArea} file found for: ${safePath}`);
+        console.log(`${requestHead} [404] ${pathname}`);
+        console.log(`Failed to decode request pathname`);
+      }
 
       try {
         await stat(filePath);