escape page and poll parameters for safety

lib/sidekiq/web/helpers.rb

@@ -2,6 +2,7 @@
 require 'uri'
 require 'set'
 require 'yaml'
+require 'cgi'
 
 module Sidekiq
   # This is not a public API
@@ -161,7 +162,7 @@ module Sidekiq
     def qparams(options)
       options = options.stringify_keys
       params.merge(options).map do |key, value|
-        SAFE_QPARAMS.include?(key) ? "#{key}=#{value}" : next
+        SAFE_QPARAMS.include?(key) ? "#{key}=#{CGI.escape(value.to_s)}" : next
       end.compact.join("&")
     end
 

test/test_web.rb

@@ -557,6 +557,12 @@ class TestWeb < Sidekiq::Test
         assert_equal 200, last_response.status
         assert_match(/#{params.first['args'][2]}/, last_response.body)
       end
+
+      it 'handles bad query input' do
+        get '/queues/foo?page=B<H'
+        assert_equal 200, last_response.status
+        assert_match(/B%3CH/, last_response.body)
+      end
     end
 
     def add_scheduled(job_id=SecureRandom.hex(12))