From 31b6ed96025bcaa1c6f7aaf9c12efd1e1b0707a8 Mon Sep 17 00:00:00 2001
From: Samantaz Fox <coding@samantaz.fr>
Date: Thu, 26 Jun 2025 19:15:12 +0000
Subject: [PATCH] pages/watch: HTML escape 'action' in download widget

Caught in the review of PR 5224, but forgot to click on "send review" in time.
I realized that too late, after the PR was already merged.
---
 src/invidious/frontend/watch_page.cr | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/invidious/frontend/watch_page.cr b/src/invidious/frontend/watch_page.cr
index 15d925e34..b8028b89b 100644
--- a/src/invidious/frontend/watch_page.cr
+++ b/src/invidious/frontend/watch_page.cr
@@ -32,7 +32,7 @@ module Invidious::Frontend::WatchPage
     return String.build(4000) do |str|
       str << "<form"
       str << " class=\"pure-form pure-form-stacked\""
-      str << " action='#{url}'"
+      str << " action='" << HTML.escape(url) << "'"
       str << " method='post'"
       str << " rel='noopener'"
       str << " target='_blank'>"