fix(route/wikipedia): escape link targets in current events

Link targets come from the wikitext, so any editor controls them, and they
went straight into an href. sanitizeHtml runs before the tags exist and does
not escape double quotes, so a target could close the attribute and add its
own, or supply a javascript: link.

Build the URL through encodeURI and linkify external URLs only when http(s).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: aavanian

lib/routes/wikipedia/current-events.ts

@@ -95,17 +95,43 @@ function stripTemplates(wikitext: string): string {
     return wikitext.replaceAll(/\{\{([^}]+)\}\}/g, '$1');
 }
 
+// sanitizeHtml runs on the wikitext before any tag is built, so & and < reach this point already
+// encoded. Decode them before assembling a URL, or the entity text ends up inside the link. &amp;
+// must go last so that &amp;lt; does not decode all the way to <.
+function decodeSanitizedEntities(text: string): string {
+    return text.replaceAll('&lt;', '<').replaceAll('&gt;', '>').replaceAll('&quot;', '"').replaceAll('&amp;', '&');
+}
+
+// Link targets come from the wikitext, so they are attacker-controlled and land in an href
+// attribute. encodeURI percent-encodes the " that would otherwise close the attribute and let the
+// rest of a crafted target through as markup, and it fixes the spaces that made the URLs invalid.
+function wikiUrl(target: string): string {
+    return `https://en.wikipedia.org/wiki/${encodeURI(decodeSanitizedEntities(target).trim().replaceAll(' ', '_'))}`;
+}
+
+// Anything that is not http(s) — javascript:, data: — is left as plain text rather than linked.
+function externalUrl(url: string): string | null {
+    const decoded = decodeSanitizedEntities(url).trim();
+    return /^https?:\/\//i.test(decoded) ? encodeURI(decoded) : null;
+}
+
 function convertWikiLinks(html: string): string {
     // Convert wiki links [[Link|Text]] or [[Link]]
-    html = html.replaceAll(/\[\[([^|\]]+)\|([^\]]+)\]\]/g, '<a href="https://en.wikipedia.org/wiki/$1">$2</a>');
-    html = html.replaceAll(/\[\[([^\]]+)\]\]/g, '<a href="https://en.wikipedia.org/wiki/$1">$1</a>');
+    html = html.replaceAll(/\[\[([^|\]]+)\|([^\]]+)\]\]/g, (_match, target: string, text: string) => `<a href="${wikiUrl(target)}">${text}</a>`);
+    html = html.replaceAll(/\[\[([^\]]+)\]\]/g, (_match, target: string) => `<a href="${wikiUrl(target)}">${target}</a>`);
     return html;
 }
 
 function convertExternalLinks(html: string): string {
-    // Convert external links [URL Text] or [URL]
-    html = html.replaceAll(/\[([^\s\]]+)\s+([^\s\]][^\]]*|\s)\]/g, '<a href="$1">$2</a>');
-    html = html.replaceAll(/\[([^\s\]]+)\]/g, '<a href="$1">$1</a>');
+    // Convert external links [URL Text] or [URL], leaving non-http(s) ones as the original text
+    html = html.replaceAll(/\[([^\s\]]+)\s+([^\s\]][^\]]*|\s)\]/g, (match, url: string, text: string) => {
+        const href = externalUrl(url);
+        return href ? `<a href="${href}">${text}</a>` : match;
+    });
+    html = html.replaceAll(/\[([^\s\]]+)\]/g, (match, url: string) => {
+        const href = externalUrl(url);
+        return href ? `<a href="${href}">${url}</a>` : match;
+    });
     return html;
 }