Make toUri sanitise all characters needed

2 files changed, 10 insertions, 6 deletions

diff --git a/hakyll.cabal b/hakyll.cabal
index 633a414..8daface 100644
--- a/hakyll.cabal
+++ b/hakyll.cabal
@@ -162,7 +162,8 @@ Library
     regex-tdfa   >= 1.1    && < 1.2,
     tagsoup      >= 0.12.6 && < 0.13,
     text         >= 0.11   && < 1.12,
-    time         >= 1.1    && < 1.5
+    time         >= 1.1    && < 1.5,
+    network      >= 2.0    && < 2.5
 
   If flag(previewServer)
     Build-depends:
@@ -238,7 +239,8 @@ Test-suite hakyll-tests
     regex-tdfa   >= 1.1    && < 1.2,
     tagsoup      >= 0.12.6 && < 0.13,
     text         >= 0.11   && < 1.12,
-    time         >= 1.1    && < 1.5
+    time         >= 1.1    && < 1.5,
+    network      >= 2.0    && < 2.5
 
   If flag(previewServer)
     Build-depends:
diff --git a/src/Hakyll/Web/Html.hs b/src/Hakyll/Web/Html.hs
index d06b7c2..3a0aa3b 100644
--- a/src/Hakyll/Web/Html.hs
+++ b/src/Hakyll/Web/Html.hs
@@ -30,6 +30,7 @@ import           System.FilePath                 (joinPath, splitPath,
 import           Text.Blaze.Html                 (toHtml)
 import           Text.Blaze.Html.Renderer.String (renderHtml)
 import qualified Text.HTML.TagSoup               as TS
+import           Network.URI                     (isUnreserved, escapeURIString)
 
 
 --------------------------------------------------------------------------------
@@ -105,10 +106,11 @@ toUrl url = case url of
     ('/' : xs) -> '/' : sanitize xs
     xs         -> '/' : sanitize xs
   where
-    -- This probably needs to be a separate function
-    sanitize = concatMap $ \c -> case c of
-        ' ' -> "%20"
-        _   -> [c]
+    -- Everything but unreserved characters should be escaped as we are
+    -- sanitising the path therefore reserved characters which have a
+    -- meaning in URI does not appear. Special casing for `/`, because it has
+    -- a special meaning in FilePath as well as in URI.
+    sanitize = escapeURIString (\c -> c == '/' || isUnreserved c)
 
 
 --------------------------------------------------------------------------------