15

The live preview of the post editor breaks links that contains two quotes, one of them in the end:

[example](http://example.com?test=param"title")

While this is rendered on the server into the proper and expected

<a href="http://example.com?test=param&quot;title&quot;">example</a>

the dynamic preview renders it into

<a href="http://example.com?test=param" title="title">example</a>

I would expect this to only happen when there is whitespace between the link title and the url, as in

[example](http://example.com?test=param "title")
10
  • 8
    Quote mark is unsafe. All unsafe characters must always be encoded within a URL. See RFC 1738 Commented Mar 23, 2017 at 12:36
  • 2
    Your URL is invalid, because not properly encoded. As a developer of a Markdown parser myself, I had to face long time ago a similar user request where our Markdown rendering was over zealous at escaping. My parser fix was to first test if the user-provided URL was valid as-is, otherwise fallback by escaping it.
    – Cœur
    Commented Mar 23, 2017 at 13:07
  • @ChristianGollhardt Yeah, that's right. I hate my browser for not applying the encoding when I copy the URL from the address bar. If I enter "x" in the SO search, it takes me to http://stackoverflow.com/search?q="x" not http://stackoverflow.com/search?q=%22x%22 :-( Btw, isn't the quote mark unsafe only when used as a delimiter?
    – Bergi
    Commented Mar 23, 2017 at 14:21
  • 2
    @Cœur Thanks, it might be true that the URL is invalid, but the bug here is that the server- and the client-side markdown parsers work differently - one treats it as a title the other doesn't.
    – Bergi
    Commented Mar 23, 2017 at 14:26
  • 1
    @Bergi strange browser. You should burninate it, throw a fox in it, and take the result :P Not sure about the sideeffects of unsafe characters in detail, but must always be encoded seems pretty clear to me. That said, Error recovery like the server version is one thing, spawning any attribute no one has declared is definitive a bug. Commented Mar 23, 2017 at 14:41
  • @ChristianGollhardt The attribute doesn't come out of nowhere, giving titles to links is a documented feature
    – Bergi
    Commented Mar 23, 2017 at 14:53
  • WOW, never seen this before :D. But I think there is no possible fix for it. Imagine you want to search for foo "BAR": https://meta.stackoverflow.com/search?q=foo "bar". If we don't escape ", why we should escape space. Commented Mar 23, 2017 at 14:58
  • @ChristianGollhardt Space is encoded as +, no problem there :-) And I don't even want " to be escaped to %22, I just want it to (not) be treated as a title attribute delimiter in the same way as the serverside markdown parser does. The bug is about consistent behaviour, not the lack of escaping.
    – Bergi
    Commented Mar 23, 2017 at 15:44
  • I think you missunderstood me. Sorry for my bad english. If you say space is encoded in +, why is quotation mark not encoded in %22? This may be true for your specific browser, but we need to think about all variations. So the question is, which parser does the right job? Imho it is the client side one. Commented Mar 23, 2017 at 15:55
  • @ChristianGollhardt I meant that spaces are encoded when I enter them in the search field (they indeed are not when I enter them right in the address bar, but my browser is not the topic here). Yeah, the client side parser might be the correct one, although I'd favour the server side one for compatibility.
    – Bergi
    Commented Mar 23, 2017 at 16:03

0

You must log in to answer this question.

Browse other questions tagged .