6

In this answer to a question, I posted a link with a special character in.

Originally it was this:

> Q: Why did the chicken cross the [Möbius strip][1]?  
> A: To get to the same side.

[1]: http://en.wikipedia.org/wiki/Möbius_strip

But the link didn't show. I have since changed it to /Mobius_strip since that URL works fine for Wikipedia, but just thought you might like to know.

Just testing to see if the link works by posting it raw:

http://en.wikipedia.org/wiki/Möbius_strip

9

As of now, the HTML sanitizer will no longer remove links that can be made conforming to its whitelist by percent-encoding the illegal characters instead. In other words: This will work as expected.

In a related but different change, free-form link recognition now allows any word characters, not just A to Z. So http://en.wikipedia.org/wiki/Möbius_strip will be recognized as a URL:

http://en.wikipedia.org/wiki/Möbius_strip

(if you edited your question now and thus force re-rendering, you'd see the same thing).

  • Note that the latter isn't yet true in comments and chat. – balpha Jul 3 '15 at 13:42
3

I intend to reuse this answer over and over until this problem is fixed or the eventual heat death of the universe, whichever comes first. Just mentally replace the parts about the parens with the specific character you are having problems with:

I doubt we'll get this fixed, but you can resolve it yourself by URL encoding ( and ) as %28 and %29. Since one of these bugs gets posted every two to three days, here's a simple rule of thumb:

Any characters in your URL other than A-Z, a-z, 0-9, and /.=?-+%&* (and the : in "http:") should probably be URL encoded.

I've cobbled together a quick page that will encode the things that shouldn't need encoding. You can find it here. It doesn't use any jQuery, so it's probably completely unreliable. If you find anything it should be encoding but isn't, let me know.

  • Nice, but there's still the (fortunately more rare) problem of unicode in hostnames. – maaartinus Jan 27 '11 at 4:30
  • the CTRL+L method of inserting hyperlinks was updated to escape a lot of the common problem characters, at least – Jeff Atwood Mar 12 '11 at 4:50
  • @maaartinus: Hostnames are punycode-encoded (http://xn-blaahblaaaahhh/) – Mechanical snail Sep 20 '12 at 22:21
  • @Mechanical snail: Hostnames? I've never seen a non-ASCII hostname, just the other parts. – maaartinus Sep 20 '12 at 23:47
  • 2
1

Similar to: The Markdown editor chokes on $ characters in URLs

There, Jeff said:

we whitelist characters and every new whitelisted char is a hole for an attack

I imagine he'd say the same thing about non-ascii characters in URLs.

0

Wikipedia supports both forms.

http://en.wikipedia.org/wiki/Mobius_strip

so use the other form.

Also note that as of recently, when entering a link via the button (or Ctrl-L), the characters will automatically be escaped.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .