Fix 4727: CSS when the request URI is invalid

CHANGELOG.md

@@ -4,6 +4,7 @@
 - Remove `duration` from prometheus labels. [4391](https://github.com/beego/beego/pull/4391)
 - Fix `unknown escape sequence` in generated code. [4385](https://github.com/beego/beego/pull/4385)
 - Fix 4590: Forget to check URL when FilterChain invoke `next()`. [4593](https://github.com/beego/beego/pull/4593)
+- Fix 4727: CSS when request URI is invalid. [4729](https://github.com/beego/beego/pull/4729)
 - Using fixed name `commentRouter.go` as generated file name. [4385](https://github.com/beego/beego/pull/4385)
 - Fix 4383: ORM Adapter produces panic when using orm.RegisterModelWithPrefix. [4386](https://github.com/beego/beego/pull/4386)
 - Fix 4444: panic when 404 not found. [4446](https://github.com/beego/beego/pull/4446)

server/web/admin.go

@@ -82,13 +82,10 @@ type adminApp struct {
 	*HttpServer
 }
 
-// Route adds http.HandlerFunc to adminApp with url pattern.
+// Run start Beego admin
 func (admin *adminApp) Run() {
 
-	// if len(task.AdminTaskList) > 0 {
-	// 	task.StartTask()
-	// }
-	logs.Warning("now we don't start tasks here, if you use task module," +
+	logs.Debug("now we don't start tasks here, if you use task module," +
 		" please invoke task.StartTask, or task will not be executed")
 
 	addr := BConfig.Listen.AdminAddr

server/web/statistics.go

@@ -16,6 +16,7 @@ package web
 
 import (
 	"fmt"
+	"html/template"
 	"sync"
 	"time"
 
@@ -98,7 +99,7 @@ func (m *URLMap) GetMap() map[string]interface{} {
 	for k, v := range m.urlmap {
 		for kk, vv := range v {
 			result := []string{
-				fmt.Sprintf("% -50s", k),
+				fmt.Sprintf("% -50s", template.HTMLEscapeString(k)),
 				fmt.Sprintf("% -10s", kk),
 				fmt.Sprintf("% -16d", vv.RequestNum),
 				fmt.Sprintf("%d", vv.TotalTime),