From 21644b2f7ccdebfd2e408c77897e62da92895f64 Mon Sep 17 00:00:00 2001
From: Sebastien Tardif <sebtardif@ncf.ca>
Date: Fri, 15 May 2026 21:27:15 -0700
Subject: [PATCH] fix: encode author names in onerror fallback to prevent XSS

The onerror handlers on testimonial avatar images interpolate t.author
directly into a JavaScript string literal. Because browsers decode HTML
entities before executing event handler attributes, a single quote in an
author name (e.g. O'Malley) breaks out of the JS string and enables
arbitrary script execution.

Apply encodeURIComponent() at build time so special characters are
percent-encoded, which both prevents the string breakout and properly
URL-encodes the ui-avatars.com name parameter.

Affects index.astro (2 instances) and shoutouts.astro (1 instance).

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
---
 src/pages/index.astro     | 4 ++--
 src/pages/shoutouts.astro | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/pages/index.astro b/src/pages/index.astro
index 7db5c777..1564d62a 100644
--- a/src/pages/index.astro
+++ b/src/pages/index.astro
@@ -125,7 +125,7 @@ const featuredPress = pressArticles.slice(0, 4);
                 alt={t.author}
                 class="testimonial-avatar"
                 loading="lazy"
-                onerror={`this.src='https://ui-avatars.com/api/?name=${t.author}&background=FF4D4D&color=fff&size=88'`}
+                onerror={`this.src='https://ui-avatars.com/api/?name=${encodeURIComponent(t.author)}&background=FF4D4D&color=fff&size=88'`}
               />
               <div class="testimonial-content">
                 <p class="testimonial-quote">"{t.quote}"</p>
@@ -142,7 +142,7 @@ const featuredPress = pressArticles.slice(0, 4);
                 alt={t.author}
                 class="testimonial-avatar"
                 loading="lazy"
-                onerror={`this.src='https://ui-avatars.com/api/?name=${t.author}&background=FF4D4D&color=fff&size=88'`}
+                onerror={`this.src='https://ui-avatars.com/api/?name=${encodeURIComponent(t.author)}&background=FF4D4D&color=fff&size=88'`}
               />
               <div class="testimonial-content">
                 <p class="testimonial-quote">"{t.quote}"</p>
diff --git a/src/pages/shoutouts.astro b/src/pages/shoutouts.astro
index ba7ded10..fde1fcc7 100644
--- a/src/pages/shoutouts.astro
+++ b/src/pages/shoutouts.astro
@@ -28,7 +28,7 @@ const allTestimonials = [...testimonials, ...extraTestimonials];
             alt={t.author}
             class="shoutout-avatar"
             loading="lazy"
-            onerror={`this.src='https://ui-avatars.com/api/?name=${t.author}&background=FF4D4D&color=fff&size=96'`}
+            onerror={`this.src='https://ui-avatars.com/api/?name=${encodeURIComponent(t.author)}&background=FF4D4D&color=fff&size=96'`}
           />
           <div class="shoutout-content">
             <p class="shoutout-quote">"{t.quote}"</p>