search

mozilla / bleach

Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes
https://bleach.readthedocs.io/en/latest/
Other
2.65k stars 252 forks source link

Linkify should not match the closing parenthesis right after the TLD #190

Closed ialbert closed 8 years ago

ialbert commented 8 years ago

Linkify handles adjacent parentheses correctly for example this will work 

(http://bar.com)

the link will go to http://bar.com

But adding a word right after the opening parenthesis will break the linking. For example when linkifying

(see  http://bar.com/)

the href will contain the closing parenthesis ) as well. Technically this is correct as the closing parenthesis is a valid construct there, in practice this is never used this way.

When accepting free user input it is surprisingly common to have users type links in the format that I mention, and it always results in invalid links. Note how just about all autolinkers (github's included correctly recognize this situation)

IMO linkify should either refuse to linkify this text or match it correctly because what it does is never correct regarding what the user intent actually was. Moreover it is very difficult to catch this error visually.

ialbert commented 8 years ago

I have added a fix for this in pull #188