web: harden saveReport with early file check, escaping, and encoding

maliberty · maliberty · commit dc5ff0dccd0d · 2026-04-13T00:10:10.000Z
- Open output file before expensive rendering to fail fast on bad paths
- Escape tile cache keys with json_escape() for valid JavaScript output
- Specify encoding='utf-8' in embed_report_assets.py for portability

Signed-off-by: Matt Liberty &lt;mliberty@precisioninno.com&gt;
diff --git a/src/web/src/embed_report_assets.py b/src/web/src/embed_report_assets.py
@@ -104,17 +104,17 @@ def main():
     # Read and process JS files.
     js_parts = []
     for path in args.js:
-        with open(path) as f:
+        with open(path, encoding="utf-8") as f:
             content = f.read()
         js_parts.append(f'// ── {path.split("/")[-1]} ──')
         js_parts.append(process_js_file(content))
     combined_js = "\n".join(js_parts)
 
     # Read CSS.
-    with open(args.css) as f:
+    with open(args.css, encoding="utf-8") as f:
         css_content = f.read()
 
-    with open(args.output, "w") as out:
+    with open(args.output, "w", encoding="utf-8") as out:
         out.write("// Auto-generated — do not edit.\n")
         out.write("#include <string_view>\n")
         out.write("namespace web {\n")
diff --git a/src/web/src/web.cpp b/src/web/src/web.cpp
@@ -1050,6 +1050,12 @@ void WebServer::saveReport(const std::string& filename,
     return;
   }
 
+  std::ofstream out(filename);
+  if (!out) {
+    logger_->error(utl::WEB, 31, "Cannot open file: {}", filename);
+    return;
+  }
+
   // ── Serialize JSON cache responses ──
 
   std::string setup_json, hold_json, hist_setup, hist_hold, filters;
@@ -1156,12 +1162,6 @@ void WebServer::saveReport(const std::string& filename,
 
   // ── Write the HTML ──
 
-  std::ofstream out(filename);
-  if (!out) {
-    logger_->error(utl::WEB, 31, "Cannot open file: {}", filename);
-    return;
-  }
-
   // HTML head — same CDN deps as index.html.
   out << R"(<!DOCTYPE html>
 <html>
@@ -1216,7 +1216,7 @@ window.__STATIC_CACHE__ = {
     if (i > 0) {
       out << ",";
     }
-    out << "\n    \"" << tile_entries[i].first << "\":\""
+    out << "\n    \"" << json_escape(tile_entries[i].first) << "\":\""
         << tile_entries[i].second << "\"";
   }
 
