From 294176c728a6ed6f4eb77053342ebf33ad6ce699 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Fi=C5=A1era?= <mara@neptuo.com>
Date: Tue, 9 Jun 2026 16:17:11 +0200
Subject: [PATCH] HTML encode target URL

---
 .../WebAssemblyNetDebugProxyAppBuilderExtensions.cs | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/mono/wasm/host/DevServer/WebAssemblyNetDebugProxyAppBuilderExtensions.cs b/src/mono/wasm/host/DevServer/WebAssemblyNetDebugProxyAppBuilderExtensions.cs
index c15f8948b2e353..a1430cfa054fae 100644
--- a/src/mono/wasm/host/DevServer/WebAssemblyNetDebugProxyAppBuilderExtensions.cs
+++ b/src/mono/wasm/host/DevServer/WebAssemblyNetDebugProxyAppBuilderExtensions.cs
@@ -333,6 +333,9 @@ public async Task Display(HttpContext context)
         var debuggerTabsListUrl = $"{_browserHost}/json";
         IEnumerable<BrowserTab> availableTabs;
 
+        var targetApplicationUrlEncoded = WebUtility.HtmlEncode(targetApplicationUrl.ToString());
+        var debuggerTabsListUrlEncoded = WebUtility.HtmlEncode(debuggerTabsListUrl);
+
         try
         {
             availableTabs = await GetOpenedBrowserTabs();
@@ -342,17 +345,17 @@ public async Task Display(HttpContext context)
             await context.Response.WriteAsync($@"
 <h1>Unable to find debuggable browser tab</h1>
 <p>
-    Could not get a list of browser tabs from <code>{debuggerTabsListUrl}</code>.
+    Could not get a list of browser tabs from <code>{debuggerTabsListUrlEncoded}</code>.
     Ensure your browser is running with debugging enabled.
 </p>
 <h2>Resolution</h2>
 <p>
     <h4>If you are using Google Chrome or Chromium for your development, follow these instructions:</h4>
-    {GetLaunchChromeInstructions(targetApplicationUrl.ToString())}
+    {GetLaunchChromeInstructions(targetApplicationUrlEncoded)}
 </p>
 <p>
     <h4>If you are using Microsoft Edge (80+) for your development, follow these instructions:</h4>
-    {GetLaunchEdgeInstructions(targetApplicationUrl.ToString())}
+    {GetLaunchEdgeInstructions(targetApplicationUrlEncoded)}
 </p>
 <strong>This should launch a new browser window with debugging enabled..</p>
 <h2>Underlying exception:</h2>
@@ -378,8 +381,8 @@ Ensure your browser is running with debugging enabled.
 
             var suffix = string.IsNullOrEmpty(targetApplicationUrl)
                 ? string.Empty
-                : $" matching the URL {WebUtility.HtmlEncode(targetApplicationUrl)}";
-            await context.Response.WriteAsync($"<p>The list of targets returned by {WebUtility.HtmlEncode(debuggerTabsListUrl)} contains no entries{suffix}.</p>");
+                : $" matching the URL {targetApplicationUrlEncoded}";
+            await context.Response.WriteAsync($"<p>The list of targets returned by {debuggerTabsListUrlEncoded} contains no entries{suffix}.</p>");
             await context.Response.WriteAsync("<p>Make sure your browser is displaying the target application.</p>");
         }
         else