alphagov/spotlight — pull request #497 by alexmuller (2014-05-14 21:26:16+00:00)
Title: Don't escape HTML entities in link tags

We occasionally see 404 responses go out from Spotlight because a client has made a request of ``GET /performance/&``.

I believe this may be because of the way Mustache is HTML-escaping entities like this:

In some clients, this might make a request matching the 404s we see, because everything after the 2nd hash is treated as a fragment and isn't sent to the server.

Anyway, just a theory. It's got some holes in it.

In any case, I think not HTML escaping the contents of href attributes is the correct thing to do.

I'm going to make a similar pull request to alphagov/govuk_template to address places this happens in the template.

/cc @annapowellsmith @robyoung because I discussed this with both of you today.