Fix: URL encode sym parameter in fetch_market_data

The `sym` parameter was inserted into the Yahoo Finance URL without URL encoding. This could potentially allow for URL manipulation/injection if a malicious symbol was passed. We now use `urlencoding::encode(sym)` to properly encode the symbol.

Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>

src-tauri/Cargo.lock

@@ -3743,6 +3743,8 @@ dependencies = [
  "tauri-plugin-process",
  "tauri-plugin-single-instance",
  "tauri-plugin-updater",
+ "url",
+ "urlencoding",
 ]
 
 [[package]]
@@ -4739,6 +4741,12 @@ dependencies = [
  "serde_derive",
 ]
 
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
 [[package]]
 name = "urlpattern"
 version = "0.3.0"

src-tauri/Cargo.toml

@@ -21,6 +21,8 @@ serde_json = "1"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }
 chrono = "0.4"
 futures = "0.3.32"
+url = "2.5.8"
+urlencoding = "2.1.3"
 
 [profile.release]
 strip = true

src-tauri/src/main.rs

@@ -494,7 +494,7 @@ async fn fetch_market_data(
         async move {
             let url = format!(
                 "https://query1.finance.yahoo.com/v8/finance/chart/{}?range=1d&interval=1d",
-                sym
+                urlencoding::encode(sym)
             );
             if let Ok(resp) = client.get(&url).send().await {
                 if let Ok(body) = resp.json::<serde_json::Value>().await {