Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inyoka Markup: [[Anchor(NA">ME)]] creates exotic HTML-ID #1352

Open
chris34 opened this issue Oct 12, 2024 · 0 comments
Open

Inyoka Markup: [[Anchor(NA">ME)]] creates exotic HTML-ID #1352

chris34 opened this issue Oct 12, 2024 · 0 comments

Comments

@chris34
Copy link
Member

chris34 commented Oct 12, 2024

For an example see

html = render('[[Anchor(NA">ME)]]')
self.assertHTMLEqual(
html,
"""<a class="crosslink anchor" href='#NA"&gt;ME' id='NA"&gt;ME'>⚓︎</a>"""
)

For JS/CSS if we we want to access them, it is needed to escape it
document.querySelectorAll('#' + CSS.escape('NA">ME'))

This can be at least non-obvious.
(As far as i see it, no HTML can be injected though)

If not all characters should be allowed in the future, the question is, if existing links get broken?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant