René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Low][ssr] head titleTemplate uses String.replace — $\u0026/$1 in title mangle output","articleBody":"## Severity: 🟢 Low (correctness — not exploitable)\n\n## Location\n[`src/ssr/head.ts:114-117`](../blob/main/src/ssr/head.ts#L114-L117).\n\n## Description\n`titleTemplate` is applied with:\n```ts\nstate.titleTemplate.replace(/%s/g, state.title)\n```\nBecause `state.title` is used as the **replacement string**, special replacement patterns (`$\u0026`, `$1`, `$'`, `` $` ``) in the title are interpreted by `String.prototype.replace` and mangle the output. Not a security issue (the result is `escapeText`'d before emission), but a correctness bug — e.g. a page titled `Q\u0026A $\u0026 more` renders incorrectly.\n\n## Suggested fix\nUse a replacer function so the title is inserted literally:\n```ts\nstate.titleTemplate.replace(/%s/g, () =\u003e state.title)\n```\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:46.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/177/bQuery/issues/177"}