fix(basket): keep & in sanitized URLs so query parameters stay separate
Merged
AD
1d ago+24+24+01234567890123456789-3-3-0123456789
Problem
sanitizeUrl reuses sanitizeString, which strips &. A tracked path such as /pricing?utm_source=x&plan=pro is stored as /pricing?utm_source=xplan=pro, which merges parameters and corrupts the stored path and referrer.
Fix
URLs now strip only <>'"; & is kept. sanitizeString behaviour is unchanged.
Tests
Added a sanitizeUrl case in validation.test.ts; the file passes under vitest.
Summary by cubic
Fixes sanitizeUrl so & is kept in stored URLs. It previously reused sanitizeString, which strips &, so /pricing?utm_source=x&plan=pro was stored as /pricing?utm_source=xplan=pro, merging query parameters and corrupting stored paths and referrers.
URLs now strip only <>'"; sanitizeString keeps stripping & as before. A test case was added to verify query parameters stay separate.