diff --git a/CHANGES.md b/CHANGES.md index cee783ed..51b91522 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -2,6 +2,7 @@ ## python-markdown2 2.5.6 (not yet released) +- [pull #749] URL-encode destinations generated by the `link-patterns` extra (#55) - [pull #746] Preserve query strings and fragments in `markdown-file-links` conversions, including reference-link targets. - [pull #739] Fix `header-ids` extra putting sanitized HTML into header ids in safe mode, which allowed attribute injection (#649) - [pull #732] Fix excessive CPU use in the inline HTML tokenizer on repeated unclosed tag fragments (#707) diff --git a/lib/markdown2.py b/lib/markdown2.py index 3632a54e..a0a8fbef 100755 --- a/lib/markdown2.py +++ b/lib/markdown2.py @@ -133,6 +133,7 @@ from collections.abc import Collection from enum import IntEnum, auto from os import urandom +from urllib.parse import quote # ---- type defs _safe_mode = Literal['replace', 'escape'] @@ -3903,7 +3904,7 @@ def run(self, text: str): continue escaped_href = ( - href.replace('"', '"') # b/c of attr quote + quote(href, safe=":/?#[]@!$&'()*+,;=%") # To avoid markdown and : .replace('*', self.md._escape_table['*']) .replace('_', self.md._escape_table['_'])) diff --git a/test/tm-cases/link_patterns_url_encoding.html b/test/tm-cases/link_patterns_url_encoding.html new file mode 100644 index 00000000..e571a7b4 --- /dev/null +++ b/test/tm-cases/link_patterns_url_encoding.html @@ -0,0 +1 @@ +

foo bar

diff --git a/test/tm-cases/link_patterns_url_encoding.opts b/test/tm-cases/link_patterns_url_encoding.opts new file mode 100644 index 00000000..f95094df --- /dev/null +++ b/test/tm-cases/link_patterns_url_encoding.opts @@ -0,0 +1,5 @@ +{"extras": ["link-patterns"], + "link_patterns": [ + (re.compile(r"^(.*)$"), r"lorem \1 ipsum"), + ], +} diff --git a/test/tm-cases/link_patterns_url_encoding.text b/test/tm-cases/link_patterns_url_encoding.text new file mode 100644 index 00000000..d675fa44 --- /dev/null +++ b/test/tm-cases/link_patterns_url_encoding.text @@ -0,0 +1 @@ +foo bar