markup/goldmark: Fix double-escaping of ampersands in link URLs

The XSS fix in 479fe6c65 accidentally called util.EscapeHTML twice
on link destinations, causing `&` to render as `&` instead
of `&`.

Fixes #14715

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

diff --git a/markup/goldmark/goldmark_integration_test.go b/markup/goldmark/goldmark_integration_test.go
index 1f7cff8b3689b976ff97a91e8b341883c4a75f84..a0347b0283b26a282598742b6720ab2426aae5ba 100644 (file)
--- a/markup/goldmark/goldmark_integration_test.go
+++ b/markup/goldmark/goldmark_integration_test.go
@@ -1047,3 +1047,24 @@ Content: {{ .Content }}
                `! alert(2)"`,
        )
 }
+
+// Issue 14715
+func TestRenderLinkDefaultAmpersand(t *testing.T) {
+       t.Parallel()
+
+       files := `
+-- content/_index.md --
+---
+title: "Home"
+---
+[foo](https://a.com/?a=1&b=2)
+-- layouts/home.html --
+{{ .Content }}
+`
+
+       b := hugolib.Test(t, files)
+
+       b.AssertFileContent("public/index.html",
+               `<a href="https://a.com/?a=1&amp;b=2">foo</a>`,
+       )
+}

diff --git a/markup/goldmark/render_hooks.go b/markup/goldmark/render_hooks.go
index 376c7dae46ca463a310885613db9eac393ac93e1..29593c7dda3992842b7d1ebf72d7c037d875f531 100644 (file)
--- a/markup/goldmark/render_hooks.go
+++ b/markup/goldmark/render_hooks.go
@@ -349,7 +349,7 @@ func (r *hookedRenderer) renderLinkDefault(w util.BufWriter, source []byte, node
                _, _ = w.WriteString("<a href=\"")
                dest := util.URLEscape(n.Destination, true)
                if r.Unsafe || !html.IsDangerousURL(dest) {
-                       _, _ = w.Write(util.EscapeHTML(util.EscapeHTML(dest)))
+                       _, _ = w.Write(util.EscapeHTML(dest))
                }
                _ = w.WriteByte('"')
                if n.Title != nil {