What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

In this question, I had an issue with the Markdown formatting being corrupted by a $ sign in the URL. The fix was to escape the $ sign as %24.

There is seemingly no reason for this, as the $ sign is not a special character in either Markdown or URLs.

Twice now, Jeff has retagged the question as support, despite the answer being that there is a bug affecting this area (and therefore it should be tagged as bug). So I'm opening a question for just the bug, without any of the case-specific baggage.

share|improve this question
    
Another example of the Markdown parser failing: meta.stackexchange.com/questions/10532/… –  Macha Aug 3 '09 at 18:58
    
if you have crazy URLs, you have to escape the content. 99% of users don't have this problem because most URLs are fairly sane. That's why it is [support] and not [bug]. –  Jeff Atwood Aug 5 '09 at 7:12
    
A google search containing the $ sign is now a crazy URL? –  Macha Aug 5 '09 at 11:21
2  
sorry, $ in an URL is just not common enough to warrant supporting it; we whitelist characters and every new whitelisted char is a hole for an attack –  Jeff Atwood Aug 14 '09 at 6:21

3 Answers 3

up vote 3 down vote accepted

There is seemingly no reason for this, as the $ sign is not a special character in either Markdown or URLs.

I'm not so sure. If I'm not mistaken, http URLs follow the generic URI syntax, and that lists $ as a reserved delimiter.

share|improve this answer

The Javascript editor chokes on the following characters:

*, $, \, [, ], ^, ', ", {, }, \

I'm sure there are others, but those are the ones right there on the keyboard for me to test. Some of those are obvious and not bugs (' and ", for example, are used to provided title text). I could test the server-side Markdown processor, but that'd be difficult and unpleasant.

The original wmd editor doesn't appear to have these bugs, which implies that it's something in the showdown engine. I would imagine the server-side version was designed to mimic the preview editor as much as possible, which would explain why the bugs persist in the rendered posts. That's just a guess, though.

share|improve this answer

I have created a Perl program to take an URL, and return the sanitized version, that will hopefully work with Markdown.

#! /usr/bin/env perl
use strict;
use warnings;

our %map;
our $swap_rx;
BEGIN{
  my $special = '%$()\' ?';
  our @special = (split '', $special);
  for my $chr ( @special, ':' ){
    my $ord = ord $chr;
    my $hex = unpack 'H2', pack 'v', $ord;
    $map{$chr} = uc $hex;
  }

  $special = quotemeta $special;
  $swap_rx = qr"[$special]";
}

for(@ARGV){
  s/($swap_rx)/'%'.$map{$1}/eg;

  if( /[a-z]{3,10}:/ ){
    undef while s(
      ([a-z]{3,10}:.*?)(:)//
    ){
      $1.'%3A//'
    }ex;
  }else{
    s/:/'%3A'/g;
  }
  print $_,"\n";
}

Feel free to use it however you like.

If you find any problems leave a comment.

It would be interesting to see a bookmarklet that does this.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .