fix(ui): support url encoded path in ui handler (#1354)

* support-urlencode-path

* fix url encoding for error_message

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

ee/tabby-webserver/Cargo.toml

@@ -37,6 +37,7 @@ tower = { version = "0.4", features = ["util"] }
 tower-http = { version = "0.4.0", features = ["fs", "trace"] }
 tracing.workspace = true
 unicase = "2.7.0"
+urlencoding = "2.1.3"
 uuid.workspace = true
 validator = { version = "0.16.1", features = ["derive"] }
 

ee/tabby-webserver/src/oauth/mod.rs

@@ -166,7 +166,7 @@ fn match_auth_result(
 
 fn make_error_redirect(provider: OAuthProvider, message: &str) -> Redirect {
     let query = querystring::stringify(vec![
-        ("error_message", message),
+        ("error_message", urlencoding::encode(message).as_ref()),
         (
             "provider",
             serde_json::to_string(&provider).unwrap().as_str(),

ee/tabby-webserver/src/ui.rs

@@ -15,8 +15,19 @@ where
     T: Into<String>,
 {
     fn into_response(self) -> Response {
+        let make_404_response = || {
+            Response::builder()
+                .status(StatusCode::NOT_FOUND)
+                .body(boxed(Full::from(WebAssets::get("404.html").unwrap().data)))
+                .unwrap_or_else(|_| panic!("Invalid response"))
+        };
+
         let path = self.0.into();
-        match WebAssets::get(path.as_str()) {
+        let Ok(decoded_path) = urlencoding::decode(&path) else {
+            return make_404_response();
+        };
+
+        match WebAssets::get(decoded_path.as_ref()) {
             Some(content) => {
                 let body = boxed(Full::from(content.data));
                 let mime = mime_guess::from_path(path).first_or_octet_stream();
@@ -25,10 +36,7 @@ where
                     .body(body)
                     .unwrap_or_else(|_| panic!("Invalid response"))
             }
-            None => Response::builder()
-                .status(StatusCode::NOT_FOUND)
-                .body(boxed(Full::from(WebAssets::get("404.html").unwrap().data)))
-                .unwrap_or_else(|_| panic!("Invalid response")),
+            None => make_404_response(),
         }
     }
 }