3

In this question, I had an issue with the Markdown formatting being corrupted by a $ sign in the URL. The fix was to escape the $ sign as %24.

There is seemingly no reason for this, as the $ sign is not a special character in either Markdown or URLs.

Twice now, Jeff has retagged the question as support, despite the answer being that there is a bug affecting this area (and therefore it should be tagged as bug). So I'm opening a question for just the bug, without any of the case-specific baggage.

4
  • Another example of the Markdown parser failing: meta.stackexchange.com/questions/10532/…
    – Macha
    Commented Aug 3, 2009 at 18:58
  • if you have crazy URLs, you have to escape the content. 99% of users don't have this problem because most URLs are fairly sane. That's why it is [support] and not [bug]. Commented Aug 5, 2009 at 7:12
  • A google search containing the $ sign is now a crazy URL?
    – Macha
    Commented Aug 5, 2009 at 11:21
  • 2
    sorry, $ in an URL is just not common enough to warrant supporting it; we whitelist characters and every new whitelisted char is a hole for an attack Commented Aug 14, 2009 at 6:21

3 Answers 3

3

There is seemingly no reason for this, as the $ sign is not a special character in either Markdown or URLs.

I'm not so sure. If I'm not mistaken, http URLs follow the generic URI syntax, and that lists $ as a reserved delimiter.

3

The Javascript editor chokes on the following characters:

*, $, \, [, ], ^, ', ", {, }, \

I'm sure there are others, but those are the ones right there on the keyboard for me to test. Some of those are obvious and not bugs (' and ", for example, are used to provided title text). I could test the server-side Markdown processor, but that'd be difficult and unpleasant.

The original wmd editor doesn't appear to have these bugs, which implies that it's something in the showdown engine. I would imagine the server-side version was designed to mimic the preview editor as much as possible, which would explain why the bugs persist in the rendered posts. That's just a guess, though.

0
0

I have created a Perl program to take an URL, and return the sanitized version, that will hopefully work with Markdown.

#! /usr/bin/env perl
use strict;
use warnings;

our %map;
our $swap_rx;
BEGIN{
  my $special = '%$()\' ?';
  our @special = (split '', $special);
  for my $chr ( @special, ':' ){
    my $ord = ord $chr;
    my $hex = unpack 'H2', pack 'v', $ord;
    $map{$chr} = uc $hex;
  }

  $special = quotemeta $special;
  $swap_rx = qr"[$special]";
}

for(@ARGV){
  s/($swap_rx)/'%'.$map{$1}/eg;

  if( /[a-z]{3,10}:/ ){
    undef while s(
      ([a-z]{3,10}:.*?)(:)//
    ){
      $1.'%3A//'
    }ex;
  }else{
    s/:/'%3A'/g;
  }
  print $_,"\n";
}

Feel free to use it however you like.

If you find any problems leave a comment.

It would be interesting to see a bookmarklet that does this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .