-
-
Notifications
You must be signed in to change notification settings - Fork 790
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Underscore is sometimes an unsafe character #347
Comments
Interesting case. What symbol can we use in return to keep the same size of default alphabet? |
I don't think there are any perfect options - the only characters that are unreserved in all contexts for URIs (aside from letters and numbers) are I think the closest would be Example: https://example.com/abcdefgh$ |
We can wrap the link with angle brackets
Since Markdown uses underscores to denotes italic text, the parser cannot accurately decide if Underscores are definitely URL safe.
Markdown SpecsMarkdown Guide CommonMark Spec defines these as "autolinks" |
I just came here to report his exact same thing, so glad to see others have the same problem. The solution I used is just to check if the last character in the id is I realise that nanoid probably shouldn't be making modifications to fix other apps bugs/quirks. However, it would be super handy if nanoid had this option built in as an optional "url-parser safety" parameter. Obviously it's only a tiny reduction in security (64^21 down to 64^20 * 63 possibilities), so can't see a problem there. |
Hello there,
Just wanted to open this issue to discuss the underscore character. It is unsafe if used at the very end of an URL on GitHub. (I also tested it on Twitter but they handle it correctly.)
Here's an example: https://example.com/abcdefgh_
I noticed this problem because I use https://www.npmjs.com/package/react-markdown in a project and it rendered a link in this broken way which did ultimately cause problems for a user. If it is happening to me then I'm sure other people are experiencing it too (perhaps unwittingly since it is kinda rare, 1/64 chance).
If a non-
_
character is added at the end then the link is no longer broken. https://example.com/abcdefgh_/Anyway, I wanted to start a discussion here to raise the problem. Perhaps the react-markdown package can be improved to handle this situation? Are there other libraries and packages that may misbehave in a similar way?
I am going to use a custom alphabet in my project. Although I find that the API for using a custom alphabet is a bit cumbersome. I will open a PR soon with a suggested API change (but I need help to finish it).
Thanks!
The text was updated successfully, but these errors were encountered: