Skip to content

Inyoka Markup: [[Anchor(NA">ME)]] creates exotic HTML-ID #1352

@chris34

Description

@chris34

For an example see

html = render('[[Anchor(NA">ME)]]')
self.assertHTMLEqual(
html,
"""<a class="crosslink anchor" href='#NA"&gt;ME' id='NA"&gt;ME'>⚓︎</a>"""
)

For JS/CSS if we we want to access them, it is needed to escape it
document.querySelectorAll('#' + CSS.escape('NA">ME'))

This can be at least non-obvious.
(As far as i see it, no HTML can be injected though)

If not all characters should be allowed in the future, the question is, if existing links get broken?

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions