[ISSUE] Preview page throws `Uncaught SyntaxError` when file URL contains a single quote character

Issue Type / 问题类型

Bug / 缺陷

kkFileView Version / kkFileView 版本

5.0.2

Deployment Mode / 部署方式

docker built from source via the official Dockerfile

Environment / 环境信息

• kkFileView version: v5.0.2 (built from source via the official Dockerfile)
• File provider: reproduced via a reverse-proxied download link from a third-party file server; not specific to any particular upstream — any URL containing an unescaped ' should trigger it

Steps to Reproduce / 复现步骤

Description

When the URL of the file being previewed contains a literal single quote (') — e.g. because the file's path/folder name contains an apostrophe such as Int'l — the generated preview page fails to load in the browser with a SyntaxError.

Root cause

A single quote is a valid sub-delims character under RFC 3986, so it's not required to be percent-encoded, and many URL builders (including upstream file providers like AList) legitimately leave it unescaped in the URL. When kkFileView renders the preview page, it appears to interpolate the raw file URL directly into a JavaScript string literal in the page template without JS-escaping it, e.g.:

var url = '${fileUrl}';

If fileUrl contains an unescaped ', it terminates the string literal early, corrupting the emitted JavaScript.

Steps to reproduce

1. Make a file available at a path containing an apostrophe, e.g. .../2009 Sinochem Int'l/report.pdf.
2. Request GET /onlinePreview?url=<base64-encoded file URL> for that file (PDF preview in this case).
3. Open the returned preview page and check the browser console.

Expected Result / 期望结果

The preview page loads and renders the document regardless of punctuation in the source URL/path.

Actual Result / 实际结果

Browser console shows: Uncaught SyntaxError: Unexpected identifier 'l' (at onlinePreview?url=...:97:80) The inline script becomes:

var url = 'https://example.com/d/.../Int'l/01-Direct%20Exp/...';

where the apostrophe in Int'l closes the string literal early, leaving l/01-Direct%20Exp/... as a bare, invalid token.

The same file works correctly when placed at a path without an apostrophe, confirming this specific character as the trigger.

Suggested fix

Escape server-supplied values before interpolating them into inline <script> blocks — e.g. using FreeMarker's ?js_string built-in when building the template:

var url = '${fileUrl?js_string}';

This is likely worth auditing across all preview templates that build a var url = '...'-style assignment (PDF, Office, video, etc.), since the same escaping gap probably exists in more than one template.

Logs & Screenshots / 日志与截图

N/A

Sample File / 样例文件（可选）

No response

Checklist / 提交前检查

• I have searched existing issues and did not find a duplicate. / 我已搜索现有 issue，未发现重复问题
• I can reproduce this issue on the stated version/environment. / 我可在上述版本与环境复现该问题
• I have masked sensitive information in logs/screenshots. / 我已对日志与截图中的敏感信息做脱敏处理