fix: HTML-escape file URLs to handle special characters in conflict and case clash dialogs

[Copilot]

Problem

File paths containing special HTML characters (single quotes ', double quotes ", ampersands &, etc.) caused links in the conflict dialog and case clash dialog to break. When users clicked "Open local version" or "Open server version" for files with these characters in their path (e.g., /some/path/folder'withsinglequote/file.ods), the links would not work.

Root Cause

The HTML anchor tags embedded file URLs directly without escaping, causing the HTML parser to incorrectly interpret special characters in the URL as HTML syntax:

linkLabel->setText(QStringLiteral("<a href=\"%1\">%2</a>").arg(fileUrl).arg(linkText));

When a file URL contained special characters, the HTML would be malformed:

<!-- Single quote breaks with single-quoted attribute -->
<a href='file:///path/folder'quote/file.txt'>Open local version</a>
         ^                  ^
         |                  |
      starts            ends (WRONG!)

<!-- Double quote breaks with double-quoted attribute -->
<a href="file:///path/folder"quote/file.txt">Open local version</a>
         ^                  ^
         |                  |
      starts            ends (WRONG!)

Solution

Properly HTML-escape the file URLs before embedding them in anchor tags using Utility::escape(), which calls Qt's toHtmlEscaped():

linkLabel->setText(QStringLiteral("<a href=\"%1\">%2</a>").arg(Utility::escape(fileUrl)).arg(linkText));

This converts special HTML characters to their entity equivalents:

• ' → '
• " → "
• & → &
• < → <
• > → >

Now all special characters are properly encoded:

<a href="file:///path/folder&#39;with&quot;quotes/file.txt">Open local version</a>
         ^                                                ^
         |                                                |
      starts                                           ends (CORRECT!)

Files Modified

• src/gui/conflictdialog.cpp (added utility.h include, line 10; escaped URL, line 125)
• src/gui/caseclashfilenamedialog.cpp (added utility.h include, line 12; escaped URL, line 206)

Testing

To reproduce and verify the fix:

1. Create folders with special characters: mkdir "test'folder" and mkdir 'test"folder'
2. Create files inside: touch "test'folder/testfile.txt"
3. Sync the folders with Nextcloud Desktop Client
4. Create conflicts by modifying the files both locally and on the server
5. Open the conflict dialog
6. Click "Open local version" or "Open server version"
7. Verify the files open correctly ✓

Impact

• ✅ Files with single quotes in their path names now open correctly
• ✅ Files with double quotes in their path names now open correctly
• ✅ Files with ampersands, less-than, greater-than, and other HTML special characters work correctly
• ✅ No regression - existing functionality for normal file paths unchanged
• ✅ Minimal change - added utility include and HTML escaping (4 lines total)
• ✅ Also fixed the same issue in case clash dialog for consistency

Fixes #

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Bug]: Conflict dialog server and client version links can't handle single quote character</issue_title>
<issue_description>### ⚠️ Before submitting, please verify the following: ⚠️

• This is a bug, not a question or a configuration issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server and Desktop Client are up to date. See Server Maintenance and Release Schedule and Desktop Releases for supported versions.
• I agree to follow Nextcloud's Code of Conduct

Bug description

I had a file conflict, which I wanted to examine. One of the folders in the path has a single quote in the folder name. I tried to open both versions to examine the conflict. None of the links worked. I wasn't able to open the files. Instead, I tried to copy the links on the dialog.
Here is the file location: /some/file/path/folder'withsinglequote/folder/folder/file.ods
Here is what was copied: /some/file/path/folder

Steps to reproduce

1. Create a folder with a single quote in the name e.g.: folder'withsinglequote
2. Sync this with the client.
3. Create a conflict.
4. Use the desktop client to resolve the conflict.
5. Click on the links for client and server versions of the file.

Expected behavior

Files should open.

Which files are affected by this bug

This is not file specific.

Operating system

Linux

Which version of the operating system you are running.

Ubuntu 22.04 LTS

Package

Official Linux AppImage

Nextcloud Server version

31.0.5

Nextcloud Desktop Client version

3.4.2

Is this bug present after an update or on a fresh install?

Updated from a minor version (ex. 3.16.1 to 3.16.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

Are you using an external user-backend?

• Default internal user-backend
• LDAP/ Active Directory
• SSO - SAML
• Other

Nextcloud Server logs

Additional info

I think that the file path parsing or handling has a bug. This does not affect overall usage. Conflicting files can be found and opened/synced in the file explorer (nautilus or nemo). It seems to be a GUI related issue. Also create debug archive button did not work for me. (perhaps another bug there)</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #8777

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[nilsding]

@copilot with this change the label now breaks with file paths containing double quotes instead

[Copilot]

@copilot with this change the label now breaks with file paths containing double quotes instead

You're absolutely right! I've fixed this by properly HTML-escaping the URLs using Utility::escape() which calls toHtmlEscaped(). This now handles both single quotes, double quotes, and other HTML special characters correctly.

The fix converts characters like ' → ' and " → " so they work properly in HTML regardless of the attribute delimiter.

Fixed in commit 327d24a.

[Rello]

A filename templates'credits.md now creates the correct link:

file:///Users/Rello/Nextcloud2/templates'credits (conflicted copy 2025-10-08 214848).md
file:///Users/Rello/Nextcloud2/templates'credits.md

[Rello]

/backport to stable-4.0

[github-actions]

Artifact containing the AppImage: nextcloud-appimage-pr-8847.zip

Digest: sha256:027dbc588dc5cad88ff284746e903d4d1af6d55342ddd9486f35b0ed5f127706

To test this change/fix you can download the above artifact file, unzip it, and run it.

Please make sure to quit your existing Nextcloud app and backup your data.

[sonarqubecloud]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)
B Maintainability Rating on New Code (required ≥ A)
3 New Code Smells (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE