From e49145023fd81864e9863cb22c3254b9e31fddbb Mon Sep 17 00:00:00 2001
From: Svilen Markov <7613769+svilenmarkov@users.noreply.github.com>
Date: Mon, 16 Dec 2024 14:05:52 +0000
Subject: [PATCH] Don't escape user-defined URLs

---
 internal/glance/templates/bookmarks.html         | 2 +-
 internal/glance/templates/docker-containers.html | 2 +-
 internal/glance/templates/monitor-compact.html   | 2 +-
 internal/glance/templates/monitor.html           | 2 +-
 internal/glance/templates/widget-base.html       | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/internal/glance/templates/bookmarks.html b/internal/glance/templates/bookmarks.html
index ad9f899..711abb6 100644
--- a/internal/glance/templates/bookmarks.html
+++ b/internal/glance/templates/bookmarks.html
@@ -13,7 +13,7 @@
                 <img class="bookmarks-icon{{ if .Icon.IsFlatIcon }} flat-icon{{ end }}" src="{{ .Icon.URL }}" alt="" loading="lazy">
             </div>
             {{ end }}
-            <a href="{{ .URL }}" class="bookmarks-link {{ if .HideArrow }}bookmarks-link-no-arrow {{ end }}color-highlight size-h4" {{ if not .SameTab }}target="_blank"{{ end }} rel="noreferrer">{{ .Title }}</a>
+            <a href="{{ .URL.String | safeURL }}" class="bookmarks-link {{ if .HideArrow }}bookmarks-link-no-arrow {{ end }}color-highlight size-h4" {{ if not .SameTab }}target="_blank"{{ end }} rel="noreferrer">{{ .Title }}</a>
         </li>
         {{ end }}
         </ul>
diff --git a/internal/glance/templates/docker-containers.html b/internal/glance/templates/docker-containers.html
index 24e5381..d9ff2d8 100644
--- a/internal/glance/templates/docker-containers.html
+++ b/internal/glance/templates/docker-containers.html
@@ -24,7 +24,7 @@
 
         <div class="min-width-0">
             {{ if .URL }}
-            <a href="{{ .URL }}" class="color-highlight size-title-dynamic block text-truncate" {{ if not .SameTab }}target="_blank"{{ end }} rel="noreferrer">{{ .Title }}</a>
+            <a href="{{ .URL | safeURL }}" class="color-highlight size-title-dynamic block text-truncate" {{ if not .SameTab }}target="_blank"{{ end }} rel="noreferrer">{{ .Title }}</a>
             {{ else }}
             <div class="color-highlight text-truncate size-title-dynamic">{{ .Title }}</div>
             {{ end }}
diff --git a/internal/glance/templates/monitor-compact.html b/internal/glance/templates/monitor-compact.html
index 32bd4ae..e888c17 100644
--- a/internal/glance/templates/monitor-compact.html
+++ b/internal/glance/templates/monitor-compact.html
@@ -21,7 +21,7 @@
 {{ end }}
 
 {{ define "site" }}
-<a class="size-title-dynamic color-highlight text-truncate block grow" href="{{ .URL }}" {{ if not .SameTab }}target="_blank"{{ end }} rel="noreferrer">{{ .Title }}</a>
+<a class="size-title-dynamic color-highlight text-truncate block grow" href="{{ .URL.String | safeURL }}" {{ if not .SameTab }}target="_blank"{{ end }} rel="noreferrer">{{ .Title }}</a>
 {{ if not .Status.TimedOut }}<div>{{ .Status.ResponseTime.Milliseconds | formatNumber }}ms</div>{{ end }}
 {{ if eq .StatusStyle "ok" }}
 <div class="monitor-site-status-icon-compact" title="{{ .Status.Code }}">
diff --git a/internal/glance/templates/monitor.html b/internal/glance/templates/monitor.html
index c164bfb..5c541a8 100644
--- a/internal/glance/templates/monitor.html
+++ b/internal/glance/templates/monitor.html
@@ -25,7 +25,7 @@
 <img class="monitor-site-icon{{ if .Icon.IsFlatIcon }} flat-icon{{ end }}" src="{{ .Icon.URL }}" alt="" loading="lazy">
 {{ end }}
 <div class="min-width-0">
-    <a class="size-h3 color-highlight text-truncate block" href="{{ .URL }}" {{ if not .SameTab }}target="_blank"{{ end }} rel="noreferrer">{{ .Title }}</a>
+    <a class="size-h3 color-highlight text-truncate block" href="{{ .URL.String | safeURL }}" {{ if not .SameTab }}target="_blank"{{ end }} rel="noreferrer">{{ .Title }}</a>
     <ul class="list-horizontal-text">
         {{ if not .Status.Error }}
         <li title="{{ .Status.Code }}">{{ .StatusText }}</li>
diff --git a/internal/glance/templates/widget-base.html b/internal/glance/templates/widget-base.html
index 5861b52..0a8e3f2 100644
--- a/internal/glance/templates/widget-base.html
+++ b/internal/glance/templates/widget-base.html
@@ -1,7 +1,7 @@
 <div class="widget widget-type-{{ .GetType }}{{ if ne "" .CSSClass }} {{ .CSSClass }}{{ end }}">
     {{ if not .HideHeader}}
     <div class="widget-header">
-        {{ if ne "" .TitleURL}}<a href="{{ .TitleURL }}" target="_blank" rel="noreferrer" class="uppercase">{{ .Title }}</a>{{ else }}<div class="uppercase">{{ .Title }}</div>{{ end }}
+        {{ if ne "" .TitleURL }}<a href="{{ .TitleURL | safeURL }}" target="_blank" rel="noreferrer" class="uppercase">{{ .Title }}</a>{{ else }}<div class="uppercase">{{ .Title }}</div>{{ end }}
         {{ if and .Error .ContentAvailable }}
         <div class="notice-icon notice-icon-major" title="{{ .Error }}"></div>
         {{ else if .Notice }}