Missing HTML encoding in generated HTML

[mephinet]

Context

While diffing the generated output of mkdocs vs zensical, I noticed that the stylesheet link contains an ampersand that is not encoded.

Bug description

Zensical's output:

<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,500i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">

Comparing this to mkdocs' output:

<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&amp;display=fallback">

IMHO mkdocs is the way to go, as entities in attribute values need to be correctly escaped as well.

Related links

Reproduction

Reproducer: https://github.com/mephinet/zensical-whitespace-reproducer/archive/refs/heads/main.zip

Steps to reproduce

grep Roboto the site/index.html

Browser

No response

Before submitting

• I have read and followed the bug reporting guidelines.
• I have attached links to the documentation, and possibly related issues.
• I assure that I have removed all customizations before submitting this bug report.
• I have attached a .zip file with a minimal reproduction.

[squidfunk]

Thanks for reporting. I'm unable to reproduce. Both mkdocs build and zensical build yield the exact same output. Here's a bare bone MkDocs project to compare outputs: issue-517.zip. In both cases I get:

# MkDocs
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback

# Zensical
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,500i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback

Zensical also includes 500,500i, the rest is identical. On a further note, the ampersand must not be encoded. If encoded, it wouldn't be detected as a query string parameter. &amp is a HTML entity. In URLs, percent-encoding is used.

[squidfunk]

So to expand on this, since @alexvoss mentioned to me in private that my reasoning might not be correct: I did some research, and after trying to find the relevant parts in the HTML spec, and writing back and forth with LLMs that change their opinion every other message, I think the reasoning is right – we should use ampersand.

I'm building websites for 20 years, and this is the first time I heard it 😅 I guess this stems from the fact that the HTML parser operates at a different level. It should be allowed to use HTML entities in URLs, and this makes the & mandatory.

[squidfunk]

Fixed in dbec3c4. The Google Fonts URL is the only URL hardcoded in the HTML templates.