From e3c55f008cc02fa7aa55d6e0e29a578f33073f9e Mon Sep 17 00:00:00 2001
From: Marc Bernard <59966492+mbtools@users.noreply.github.com>
Date: Sat, 2 Nov 2024 05:31:21 -0400
Subject: [PATCH] chore: encode parts of URL (#4922)

---
 .changeset/rude-birds-design.md          | 5 +++++
 packages/verdaccio/src/server/request.ts | 4 ++--
 2 files changed, 7 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/rude-birds-design.md

diff --git a/.changeset/rude-birds-design.md b/.changeset/rude-birds-design.md
new file mode 100644
index 000000000..5dd94d444
--- /dev/null
+++ b/.changeset/rude-birds-design.md
@@ -0,0 +1,5 @@
+---
+'verdaccio': patch
+---
+
+chore: encode parts of URL
diff --git a/packages/verdaccio/src/server/request.ts b/packages/verdaccio/src/server/request.ts
index 93df9e7f9..647ecf2c1 100644
--- a/packages/verdaccio/src/server/request.ts
+++ b/packages/verdaccio/src/server/request.ts
@@ -216,7 +216,7 @@ export class ServerQuery {
    */
   public removePackage(name: string, rev) {
     return this.request({
-      uri: `/${encodeURIComponent(name)}/-rev/${rev}`,
+      uri: `/${encodeURIComponent(name)}/-rev/${encodeURIComponent(rev)}`,
       method: 'DELETE',
       headers: {
         [HEADERS.CONTENT_TYPE]: HEADERS.JSON_CHARSET,
@@ -226,7 +226,7 @@ export class ServerQuery {
 
   public removeSingleTarball(name: string, filename: string) {
     return this.request({
-      uri: `/${encodeURIComponent(name)}/-/${filename}/-rev/whatever`,
+      uri: `/${encodeURIComponent(name)}/-/${encodeURIComponent(filename)}/-rev/whatever`,
       method: 'DELETE',
       headers: {
         [HEADERS.CONTENT_TYPE]: HEADERS.JSON_CHARSET,