fix: do not unescape query and hash in URLs when clicking links (closes #4453, closes #4232) #4454
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, the search query and hash of a URL are unescaped when clicking them. This means that if escaped characters are used in these pieces of links, they will be replaced. If they are URL characters like
&this can change behavior (#4453). If they are characters like newlines, they may disappear from the URL entirely (#4232).I guess this is technically a breaking change but I'm not sure that unescaping these portions is ever actually the correct choice. I guess I'd be curious to hear from anyone for whom this would cause issues.
Note that values are unescaped in
use_query_map()etc. in any case, so that?arg=foo%26a%3Dbarwas and is still interpreted as a param of the valuefoo&a=bar.