Issue Type / 问题类型
Bug / 缺陷
kkFileView Version / kkFileView 版本
5.0.2
Deployment Mode / 部署方式
docker built from source via the official Dockerfile
Environment / 环境信息
- kkFileView version: v5.0.2 (built from source via the official Dockerfile)
- File provider: reproduced via a reverse-proxied download link from a third-party file server; not specific to any particular upstream — any URL containing an unescaped
' should trigger it
Steps to Reproduce / 复现步骤
Description
When the URL of the file being previewed contains a literal single quote (') — e.g. because the file's path/folder name contains an apostrophe such as Int'l — the generated preview page fails to load in the browser with a SyntaxError.
Root cause
A single quote is a valid sub-delims character under RFC 3986, so it's not required to be percent-encoded, and many URL builders (including upstream file providers like AList) legitimately leave it unescaped in the URL. When kkFileView renders the preview page, it appears to interpolate the raw file URL directly into a JavaScript string literal in the page template without JS-escaping it, e.g.:
If fileUrl contains an unescaped ', it terminates the string literal early, corrupting the emitted JavaScript.
Steps to reproduce
- Make a file available at a path containing an apostrophe, e.g.
.../2009 Sinochem Int'l/report.pdf.
- Request
GET /onlinePreview?url=<base64-encoded file URL> for that file (PDF preview in this case).
- Open the returned preview page and check the browser console.
Expected Result / 期望结果
The preview page loads and renders the document regardless of punctuation in the source URL/path.
Actual Result / 实际结果
Browser console shows:
Uncaught SyntaxError: Unexpected identifier 'l' (at onlinePreview?url=...:97:80)
The inline script becomes:
var url = 'https://example.com/d/.../Int'l/01-Direct%20Exp/...';
where the apostrophe in Int'l closes the string literal early, leaving l/01-Direct%20Exp/... as a bare, invalid token.
The same file works correctly when placed at a path without an apostrophe, confirming this specific character as the trigger.
Suggested fix
Escape server-supplied values before interpolating them into inline <script> blocks — e.g. using FreeMarker's ?js_string built-in when building the template:
var url = '${fileUrl?js_string}';This is likely worth auditing across all preview templates that build a var url = '...'-style assignment (PDF, Office, video, etc.), since the same escaping gap probably exists in more than one template.
Logs & Screenshots / 日志与截图
Sample File / 样例文件（可选）
No response
Checklist / 提交前检查
Issue Type / 问题类型
Bug / 缺陷
kkFileView Version / kkFileView 版本
5.0.2
Deployment Mode / 部署方式
docker built from source via the official Dockerfile
Environment / 环境信息
'should trigger itSteps to Reproduce / 复现步骤
Description
When the URL of the file being previewed contains a literal single quote (
') — e.g. because the file's path/folder name contains an apostrophe such asInt'l— the generated preview page fails to load in the browser with aSyntaxError.Root cause
A single quote is a valid
sub-delimscharacter under RFC 3986, so it's not required to be percent-encoded, and many URL builders (including upstream file providers like AList) legitimately leave it unescaped in the URL. When kkFileView renders the preview page, it appears to interpolate the raw file URL directly into a JavaScript string literal in the page template without JS-escaping it, e.g.:If
fileUrlcontains an unescaped', it terminates the string literal early, corrupting the emitted JavaScript.Steps to reproduce
.../2009 Sinochem Int'l/report.pdf.GET /onlinePreview?url=<base64-encoded file URL>for that file (PDF preview in this case).Expected Result / 期望结果
The preview page loads and renders the document regardless of punctuation in the source URL/path.
Actual Result / 实际结果
Browser console shows:
Uncaught SyntaxError: Unexpected identifier 'l' (at onlinePreview?url=...:97:80)
The inline script becomes:
where the apostrophe in
Int'lcloses the string literal early, leavingl/01-Direct%20Exp/...as a bare, invalid token.The same file works correctly when placed at a path without an apostrophe, confirming this specific character as the trigger.
Suggested fix
Escape server-supplied values before interpolating them into inline
<script>blocks — e.g. using FreeMarker's?js_stringbuilt-in when building the template:var url = '${fileUrl?js_string}';This is likely worth auditing across all preview templates that build a
var url = '...'-style assignment (PDF, Office, video, etc.), since the same escaping gap probably exists in more than one template.Logs & Screenshots / 日志与截图
Sample File / 样例文件（可选）
No response
Checklist / 提交前检查