vmg / rinku

Autolinking. Ruby. Yes, that's pretty much it.
ISC License
597 stars 67 forks source link

Rinku should assume HTML encoded input #14

Closed rtomayko closed 12 years ago

rtomayko commented 12 years ago

I'm seeing a lot of issues that seem to stem from Rinku trying to detect whether input is HTML encoded or not. #6 is one example.

Here's another:

>> Rinku.auto_link("This text is HTML encoded: http://example.com?x=1&y=2")
=> "This text is HTML encoded: <a href=\"http://example.com?x=1&amp;amp;y=2\">http://example.com?x=1&amp;amp;y=2</a>"

It's actually responsible for mangling the real text in this comment even. Here's the actual text I pasted:

https://gist.github.com/846f567ad158730811a2

Input into Rinku should always be HTML encoded. Why is it re-encoding in all these circumstances?

vmg commented 12 years ago

Hm. I remember having to re-encode it to comply with the Rails test suite... Let me look into that, I'm going to add a toggle.

rtomayko commented 12 years ago

I want to say the Rails autolinker tries to work with plain text (non HTML encoded) input, which is a fatal flaw in its design IMO. There's no way to correctly process this stuff unless you know whether the input is HTML encoded or not. I'd recommend mandating that input be HTML encoded.

With Rails 3 you could even check for html_safe? and fail fast or go ahead and do the conversion.

vmg commented 12 years ago

Your wish is my command. 1.4.0 removes all escaping, and performs the escaping on the Rails 3 monkeypatch method. How's that?

rtomayko commented 12 years ago

:metal:

rtomayko commented 12 years ago

Confirmed this fixes everything for us.