[songgaoye]

What problem does this PR solve?

Issue Number: resolve

Problem Summary:
Builtin /dir and hotspots pages render filesystem-derived names into HTML.
A malicious directory entry or historical profiler filename could inject HTML
into the builtin management UI.

What is changed and the side effects?

Changed:

• Escape HTML link text and href values emitted by Path.
• Escape profiler filenames in HTML option values and visible text.
• Encode profiler view and base paths in generated URLs, then decode and
  validate them in both profiler handlers.
• Add regression tests for hostile names and encoded profile paths.

Side effects:

• Performance effects: Negligible; escaping/encoding only occurs while
  rendering builtin management pages.

• Breaking backward compatibility: No. Existing raw view and base query
  parameters remain supported.

---

Check List:

• Please make sure your changes are compilable.
• When providing us with a new feature, it is best to add related tests.
• Please follow Contributor Covenant Code of Conduct.

[Copilot]

🟡 Changes recommended

An active moderate issue remains: non-responsive diff/base profile requests encode the base path but DisplayResult does not decode it, causing those requests to fail with an invalid base query.

1 open issue

• Decode base query before validating non-responsive requests · New

What changed in this PR

This PR hardens built-in directory and profiler management pages against HTML injection from filesystem-derived names and safely encodes profiler paths in generated URLs.

Changes:

• Escape directory links, profiler option values, and visible profiler names.
• Add prefixed percent encoding and validation for profiler view and base query paths.
• Add regression tests for hostile names, encoded paths, and rendered links.

File	Description
test/​brpc_builtin_service_unittest.cpp	Adds regression tests covering hostile directory and profiler names, encoded profiler paths, and HTML link rendering.
src/​brpc/​builtin/​hotspots_service.cpp	Encodes and validates profiler paths in generated URLs and escapes profiler filenames in HTML output.
src/​brpc/​builtin/​common.cpp	Escapes directory link URLs and displayed text when rendering HTML.

_{Review effort: Lite}

[wwbmmm]

[replied by brpc-oncall robot] The added HTML escaping is the right direction, but the new prefixed path encoding is applied asymmetrically (Copilot already flagged that base is encoded into the non-responsive URL yet never decoded before validation in DisplayResult, so every diff/base view fails), and the encoding layer duplicates a hard-coded prefix in the inline JS while adding no protection beyond what ValidProfilePath already enforces.

[Copilot]

🟡 Changes recommended

Two moderate active issues remain: generated URLs do not percent-encode reserved filename and query characters, so valid paths cannot be selected reliably and may be misinterpreted by browsers.

2 open issues

• Percent-encode filename components in directory links · New
• Encode query values and decode them in request handlers · New

1 resolved since last review

• Decode base query before validating non-responsive requests

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

Approval is blocked by unresolved path round-trip and query-encoding issues, a critical profiling-directory traversal risk, and a regression test that does not exercise the escaping behavior.

2 open issues

• Percent-encoded directory paths do not round-trip · New
• Regression test never reaches profiler-name escaping · New

1 previously missed issue

In code that hasn't changed since last review

Path-prefix validation allows access outside the profiling directory

src/​brpc/​builtin/​hotspots_service.cpp:1069

ValidProfilePath only checks starts_with(FLAGS_rpc_profiling_dir), so a sibling such as ./rpc_data/profiling_evil/... also passes when the configured directory is ./rpc_data/profiling. The view/base values are later passed to pprof, allowing an HTTP caller to select files outside the profiling directory; checking the enumerated names here does not fix that handler path. Require a directory boundary (or canonicalize and verify the parent) before accepting the path.

2 resolved since last review

• Encode query values and decode them in request handlers
• Percent-encode filename components in directory links

_{Review effort: Lite}