Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Images with space in the URI don't get parsed #1369

Closed
woodyrew opened this issue Oct 29, 2018 · 4 comments
Closed

Images with space in the URI don't get parsed #1369

woodyrew opened this issue Oct 29, 2018 · 4 comments
Labels

Comments

@woodyrew
Copy link

Images with spaces in the filepath are no longer being parsed correctly.

To Reproduce
Process the following doesn't see match an image.
![Example image](https://example.com/image space.png)

See Marked Demo for example

  1. Install marked npm install --save marked@0.5.1 with the version you are using
  2. Run marked with input string and options such as marked('![Example image](https://example.com/image space.png)', {sanitize: true})

Expected behavior
Expected the url to be made html friendly with the switch sanitize by replacing spaces with %20.

@UziTech
Copy link
Member

UziTech commented Oct 29, 2018

Looks like it is acting the way it is supposed to.

common mark demo

according to the Common Mark Spec:

A link destination consists of either

  • a sequence of zero or more characters between an opening < and a closing > that contains no spaces, line breaks, or unescaped < or > characters, or

  • a nonempty sequence of characters that does not include ASCII space or control characters, and includes parentheses only if (a) they are backslash-escaped or (b) they are part of a balanced pair of unescaped parentheses. (Implementations may impose limits on parentheses nesting to avoid performance issues, but at least three levels of nesting should be supported.)

@styfle
Copy link
Member

styfle commented Oct 29, 2018

The workaround is to use url encoding like so ![Example image](https://example.com/image%20space.png)

Notice that the space character is encoded as %20


Update: I missed your last line about sanitize.

Sanitizing is about handling attacks, not fixing typos.
We actually have a proposal to remove sanitization in #1232 so you should avoid that option if you can.

@woodyrew
Copy link
Author

I'm aware of the Common Mark Spec and the workaround but it feels within the scope of the sanitize switch to address this.

@UziTech
Copy link
Member

UziTech commented Oct 30, 2018

As @styfle mentioned above sanitize is meant to prevent XSS attacks not fix typos.

The only way to fix your issue would be to replace the space with %20 before passing it to marked.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants