Repository navigation
Preserve balanced parentheses in rendered Markdown link destinations #37
Description
The regex for Markdown destinations stops at the first closing parenthesis. A normal link such as https://example.test/A_(B) becomes a link to https://example.test/A_(B with an extra visible closing parenthesis. Fix bounded destination parsing while keeping escape-first rendering and the existing URL allowlist.
Bounty: 50 points · Priority: P3 · Type: confirmed-bug
Points only; no monetary payment.
Review ID: AP-12 · Reviewed revision: b375588301b8
Acceptance criteria
- Add bounded balanced-parenthesis/escaped-parenthesis parsing for supported inline links without permitting raw HTML.
- Cover common documentation/Wikipedia URLs, nested parentheses, escaped closing characters, malformed input and surrounding emphasis/code.
- Retain unsafe-scheme rejection, attribute escaping and forged-fragment protections; run Markdown renderer tests and coverage.
Evidence at the reviewed revision
- backend/webrender/sanitize.py:28: Destination regex excludes every closing parenthesis.
- tests/webrender/test_markdown_links.py:26: Current literal-URL coverage has underscores and punctuation but no balanced destination parentheses.
Verification and limits
Confirmed inline_md reproduction using a synthetic URL; no network navigation performed.
Activity
github-actions commentedon Oct 2, 2026
@makar52nn2016-jpg claim status: rejected. Finish or release your existing bounty first.
One active task per contributor. Reservations last seven days. Post a new
/unclaimcomment here to release yours. UseCloses #Nin your PR description. A configured maintainer’s merge awards points automatically, including their own work. Points have no cash value.xiasan1992 commentedon Oct 3, 2026
/claim
github-actions commentedon Oct 3, 2026
@xiasan1992 claim status: released. This reservation is no longer active. Choose an available task and post a new /claim comment.
One active task per contributor. Reservations last seven days. Post a new
/unclaimcomment here to release yours. UseCloses #Nin your PR description. A configured maintainer’s merge awards points automatically, including their own work. Points have no cash value.xiasan1992 commentedon Oct 3, 2026
/claim
I will add bounded balanced-parenthesis parsing for inline Markdown destinations and regression coverage for nested/escaped parentheses, malformed input, and surrounding formatting while preserving scheme, HTML, escaping, and fragment protections.
github-actions commentedon Oct 3, 2026
@xiasan1992 claim status: released. This reservation is no longer active. Choose an available task and post a new /claim comment.
One active task per contributor. Reservations last seven days. Post a new
/unclaimcomment here to release yours. UseCloses #Nin your PR description. A configured maintainer’s merge awards points automatically, including their own work. Points have no cash value.xiasan1992 commentedon Oct 3, 2026
/unclaim
github-actions commentedon Oct 3, 2026
@xiasan1992 claim status: released. This reservation is no longer active. Choose an available task and post a new /claim comment.
One active task per contributor. Reservations last seven days. Post a new
/unclaimcomment here to release yours. UseCloses #Nin your PR description. A configured maintainer’s merge awards points automatically, including their own work. Points have no cash value.xiasan1992 commentedon Oct 3, 2026
The original /claim remains queued even though the coordinator ledger currently lists it as active. I posted /unclaim at 2026-10-03 15:59Z; its receipt is also still queued, and the later claim on AstralPrimitives #14 is pending. I have not started implementation because the bot requires Reserved. Could the claims reconcile the release or confirm the active reservation state?
armstrongsam25 commentedon Oct 5, 2026
@xiasan1992 The current bot receipts here now mark both your claim and
/unclaimas released. Your later AstralPrimitives #14 receipt confirms Reserved and assigned until 2026-10-10T21:42:39.940Z. That resolves the queued status described in your comment; keep #14 as your one active reservation. Technical review of PR #44 remains separate and still requires the bounded-work correction.