diff --git a/lib/core/index.js b/lib/core/index.js index e386c541..5a1764b0 100644 --- a/lib/core/index.js +++ b/lib/core/index.js @@ -36,7 +36,6 @@ function decodePathname(pathname) { const nonUrlSafeCharsRgx = /[\x00-\x1F\x20\x7F-\uFFFF]+/g; function ensureUriEncoded(text) { - return text return String(text).replace(nonUrlSafeCharsRgx, encodeURIComponent); } diff --git a/lib/core/show-dir/index.js b/lib/core/show-dir/index.js index 001e41a2..dcfbde73 100644 --- a/lib/core/show-dir/index.js +++ b/lib/core/show-dir/index.js @@ -15,6 +15,17 @@ const status = require('../status-handlers'); const supportedIcons = styles.icons; const css = styles.css; +// Only escape HTML-unsafe characters, preserve CJK/unicode as-is for +// clients that do not decode HTML entities (e.g. Switch DBI). +function escapeHtml(str) { + return String(str) + .replace(/&/g, '&') + .replace(//g, '>') + .replace(/"/g, '"') + .replace(/'/g, '''); +} + module.exports = (opts) => { // opts are parsed by opts.js, defaults already applied const cache = opts.cache; @@ -69,7 +80,7 @@ module.exports = (opts) => { files = files.filter(filename => filename.slice(0, 1) !== '.'); } - res.setHeader('content-type', 'text/html'); + res.setHeader('content-type', 'text/html; charset=utf-8'); res.setHeader('etag', etag(stat, weakEtags)); res.setHeader('last-modified', (new Date(stat.mtime)).toUTCString()); res.setHeader('cache-control', cache); @@ -127,11 +138,11 @@ module.exports = (opts) => { '
', ' ', ' ', - `