From 91c94bde88ce3498c54369cc9c173817d6c5a17c Mon Sep 17 00:00:00 2001
From: tech <tech@bamboogames.net>
Date: Wed, 4 Mar 2026 01:59:53 +0800
Subject: [PATCH] fix: add URL encoding and remove unused import

- Add encodeURIComponent() for project, version, and filename parameters in downloadUrl to prevent XSS and URL breakage
- Remove unused formatDateTime import

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 app/api/apks/route.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/api/apks/route.ts b/app/api/apks/route.ts
index f004760..7196ec1 100644
--- a/app/api/apks/route.ts
+++ b/app/api/apks/route.ts
@@ -1,6 +1,6 @@
 // app/api/apks/route.ts
 import { NextResponse } from 'next/server';
-import { getApks, formatDateTime } from '@/lib/fs-utils';
+import { getApks } from '@/lib/fs-utils';
 
 export async function GET(request: Request) {
   const { searchParams } = new URL(request.url);
@@ -20,7 +20,7 @@ export async function GET(request: Request) {
     const apksWithUrls = apks.map(apk => ({
       ...apk,
       modifiedAt: apk.modifiedAt.toISOString(),
-      downloadUrl: `/api/download?project=${project}&version=${version}&filename=${apk.name}`,
+      downloadUrl: `/api/download?project=${encodeURIComponent(project)}&version=${encodeURIComponent(version)}&filename=${encodeURIComponent(apk.name)}`,
     }));
     return NextResponse.json(apksWithUrls);
   } catch (error) {