Profile ids are not escaped when building links

[chrisdeely]

Profile IDs are arbitrary strings, but they are used directly without sanitization when building URLs to view a profile's details.

Example from apps/start/src/components/profiles/table/columns.tsx

   <ProjectLink
            href={`/profiles/${profile.id}`}
            className="flex items-center gap-2 font-medium"
            title={getProfileName(profile, false)}
          >

When a profile ID has non-url-safe characters, this breaks the link by generating a url like /profiles/xyz/123 for the id xyz/123.

Obviously a simple answer is "use better ids" 😆 but I'm dealing with some legacy data we need to maintain.

This likely extends to other areas of the UI where links and queries are generated using unsafe user-provided content.

[lindesvard]

All inputs with SQL are escaped and this issue is now fixed and live. Thanks for reporting.

PS. everybody has luggage 😅

[chrisdeely]

Wow, that was fast! I had been planning to open a PR but you beat me to it! 😂 Thanks!