fix(basket): keep & in sanitized URLs so query parameters stay separate

[Adityakk9031]

Problem

sanitizeUrl reuses sanitizeString, which strips &. A tracked path such as /pricing?utm_source=x&plan=pro is stored as /pricing?utm_source=xplan=pro, which merges parameters and corrupts the stored path and referrer.

Fix

URLs now strip only <>'"; & is kept. sanitizeString behaviour is unchanged.

Tests

Added a sanitizeUrl case in validation.test.ts; the file passes under vitest.

---

Summary by cubic

Fixes sanitizeUrl so & is kept in stored URLs. It previously reused sanitizeString, which strips &, so /pricing?utm_source=x&plan=pro was stored as /pricing?utm_source=xplan=pro, merging query parameters and corrupting stored paths and referrers.

URLs now strip only <>'"; sanitizeString keeps stripping & as before. A test case was added to verify query parameters stay separate.

^{Written for commit a49620e. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
dashboard	Skipped		Oct 15, 2026 11:32am UTC
documentation	Skipped		Oct 15, 2026 11:32am UTC

[vercel]

@Adityakk9031 is attempting to deploy a commit to the Databuddy OSS Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1c0c8805-7d76-4b9c-a298-561cec33631d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] This PR appears safe to merge.

Summary

sanitizeUrl now keeps &, so stored URLs retain separate query parameters.

• Tracked URLs keep their query parameters separate.

_{Reviews (1) · Last reviewed commit: "fix(basket): keep & in sanitized URLs so..." · Reviewed by Greptile}