CodeRabbit flagged that the JS in `reports/apiCalls/*ApiParams.jsp` builds API URLs by concatenating raw `selectedRouteId` / `stopId` / `tripId` / `format` / etc. into the query string before redirecting. Route ids that contain reserved characters (`&`, `=`, `+`, space, `#`) will silently corrupt the request. Wrap each dynamic value in `encodeURIComponent(...)`.
Source
CodeRabbit flagged that the JS in `reports/apiCalls/*ApiParams.jsp` builds API URLs by concatenating raw `selectedRouteId` / `stopId` / `tripId` / `format` / etc. into the query string before redirecting. Route ids that contain reserved characters (`&`, `=`, `+`, space, `#`) will silently corrupt the request. Wrap each dynamic value in `encodeURIComponent(...)`.
Source