Documentation
¶
Overview ¶
Command linkify turns bare URLs in a document's text into links, without breaking the links it already has.
This is the first program here that inserts markup on purpose, and it needs both escapers at once, for the same URL:
<a href="` + EscapeAttribute(u) + `">` + EscapeText(u) + `</a>
The two are not the same function. EscapeAttribute escapes five characters because the markup is being built by hand and could use either quote; EscapeText escapes three because that is what the library writes for Text. A URL containing "&" needs both, differently, and using one for both positions is the mistake this program exists to not make.
Escaping is not sanitising, which matters more here than anywhere else in these examples: EscapeAttribute will produce a perfectly well-formed href of "javascript:alert(1)". So the scheme is checked before anything is built, and only http and https get through. That check is the security boundary; the escaping only keeps the markup well-formed.
Not breaking existing anchors is a depth counter, because no selector says "not inside an <a>". Nesting a link inside a link produces something a parser unnests into markup nobody wrote, so the counter is the difference between a rewrite and a corruption.
The text is matched over the accumulated node, decoded once, and the parts around each URL are written back with EscapeText - so a document whose text contains "&" keeps it, rather than gaining another escape on every pass.
Source Files