# The Markdown editor chokes on $characters in URLs In this question, I had an issue with the Markdown formatting being corrupted by a$ sign in the URL. The fix was to escape the $sign as %24. There is seemingly no reason for this, as the$ sign is not a special character in either Markdown or URLs.

Twice now, Jeff has retagged the question as support, despite the answer being that there is a bug affecting this area (and therefore it should be tagged as bug). So I'm opening a question for just the bug, without any of the case-specific baggage.

-
Another example of the Markdown parser failing: meta.stackexchange.com/questions/10532/… –  Macha Aug 3 '09 at 18:58
if you have crazy URLs, you have to escape the content. 99% of users don't have this problem because most URLs are fairly sane. That's why it is [support] and not [bug]. –  Jeff Atwood Aug 5 '09 at 7:12
A google search containing the $sign is now a crazy URL? – Macha Aug 5 '09 at 11:21 sorry,$ in an URL is just not common enough to warrant supporting it; we whitelist characters and every new whitelisted char is a hole for an attack –  Jeff Atwood Aug 14 '09 at 6:21

There is seemingly no reason for this, as the $sign is not a special character in either Markdown or URLs. I'm not so sure. If I'm not mistaken, http URLs follow the generic URI syntax, and that lists$ as a reserved delimiter.

-

The Javascript editor chokes on the following characters:

*, $, \, [, ], ^, ', ", {, }, \ I'm sure there are others, but those are the ones right there on the keyboard for me to test. Some of those are obvious and not bugs (' and ", for example, are used to provided title text). I could test the server-side Markdown processor, but that'd be difficult and unpleasant. The original wmd editor doesn't appear to have these bugs, which implies that it's something in the showdown engine. I would imagine the server-side version was designed to mimic the preview editor as much as possible, which would explain why the bugs persist in the rendered posts. That's just a guess, though. - I have created a Perl program to take an URL, and return the sanitized version, that will hopefully work with Markdown. #! /usr/bin/env perl use strict; use warnings; our %map; our$swap_rx;
BEGIN{
my $special = '%$()\' ?';
our @special = (split '', $special); for my$chr ( @special, ':' ){
my $ord = ord$chr;
my $hex = unpack 'H2', pack 'v',$ord;
$map{$chr} = uc $hex; }$special = quotemeta $special;$swap_rx = qr"[$special]"; } for(@ARGV){ s/($swap_rx)/'%'.$map{$1}/eg;

if( /[a-z]{3,10}:/ ){
undef while s(
([a-z]{3,10}:.*?)(:)//
){
$1.'%3A//' }ex; }else{ s/:/'%3A'/g; } print$_,"\n";
}


Feel free to use it however you like.