Fix affiliate links corrupted by ampersand-stripping sanitizer (1.52.1)

validateAndSanitizeCSVRow stripped < > " ' & from every string cell,
deleting the & query-param separators in affiliate/image/review URLs.
A TireRack link like ?tireMake=…&tireModel=…&partnum=… collapsed into
one param, so the retailer couldn't resolve the product and bounced the
click to its homepage. Same latent break hit review links (e.g. YouTube
watch?v=…&t=…) and any image URL with a query string.

Exclude the URL/identifier columns (18 link, 19 image, 22 review_link,
28 slug) from the strip, matching the existing 27 (vehicle_breakdown
JSON) exception. Each URL field is still validated by its own strict
allowlist helper (safeLinkURL / safeImageURL / safeReviewLinkURL)
before use, so <>"' can't slip through.

Stored data was never affected — the & were always correct in the DB;
only the rendered link was corrupted, so no data repair is needed.

Verified the full pipeline (row sanitizer -> safeLinkURL) preserves the
URL; build regenerated; 83/83 JS tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: RivianTrackr

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to the Rivian Tire Guide plugin will be documented in this f
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.52.1] - 2026-07-02
+
+### Fixed
+- **Affiliate/review/image links with query strings were silently broken.** The client-side row sanitizer (`validateAndSanitizeCSVRow`) stripped `< > " ' &` from every string cell, which deleted the `&` separators inside URLs — e.g. `?tireMake=…&tireModel=…&partnum=…` collapsed into a single param, so retailers like TireRack couldn't resolve the product and redirected clicks to their homepage. The affiliate link (index 18), image (19), and review link (22) columns — plus the slug (28) — are now excluded from that strip, matching the existing exception for the JSON `vehicle_breakdown` column (27). These fields are still validated by their own strict allowlist helpers (`safeLinkURL` / `safeImageURL` / `safeReviewLinkURL`) before use, so nothing unsafe slips through. Stored data was never affected — the `&` were always correct in the database; only the rendered link was corrupted.
+
 ## [1.52.0] - 2026-07-02
 
 ### Added

frontend/js/modules/validation.js

@@ -211,8 +211,14 @@ export function validateAndSanitizeCSVRow(row) {
     const cell = row[i];
 
     if (typeof cell === "string") {
-      // Index 27 (vehicle_breakdown) contains JSON — preserve quotes.
-      if (i === 27) {
+      // Some columns must NOT have <>"'& stripped:
+      //   18 link, 19 image, 22 review_link — URLs where & separates query
+      //     params (stripping it corrupts the destination); each is validated
+      //     by its own strict allowlist helper (safeLinkURL / safeImageURL /
+      //     safeReviewLinkURL) before use, so <>"' can't slip through.
+      //   27 vehicle_breakdown — JSON, needs its quotes.
+      //   28 slug — identifier, url-encoded at use.
+      if (i === 18 || i === 19 || i === 22 || i === 27 || i === 28) {
         sanitized[i] = cell;
       } else {
         sanitized[i] = cell.replace(/[<>\"'&]/g, "").trim();

frontend/js/rivian-tires.min.js

@@ -1,6 +1,6 @@
 {
   "name": "rivian-tire-guide",
-  "version": "1.52.0",
+  "version": "1.52.1",
   "private": true,
   "description": "Interactive tire guide for Rivian vehicles — WordPress plugin",
   "scripts": {