Defect #44718
openLinks to headings containing quotes break after upgrading to Rails 8.1.4.1
Description
After upgrading to Rails 8.1.4.1 #44711 , generated anchors for headings containing quotes change, breaking existing links. This affects both Textile and Markdown.
This is caused by a security fix in Rails' strip_tags, which now escapes single and double quotes in its output.
https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7
For example, the anchor for Bob's guide changes from Bobs-guide to Bob39s-guide. Wiki links such as [[#Bob's guide]] and [[#Bobs-guide]] no longer navigate to the heading. Previously saved URLs ending in #Bobs-guide are also affected.
Automatically generated TOC and paragraph-sign links still work because they use the new anchor names.
Files
Related issues
Updated by Katsuya HIDAKA about 6 hours ago
- File 0001-Fix-broken-links-to-headings-containing-quotes.patch 0001-Fix-broken-links-to-headings-containing-quotes.patch added
I'm attaching a patch to fix this issue.
- Use the same sanitizer as
strip_tagsto remove HTML tags, and generate anchors before escaping quotes. - Preserve protection against HTML injection:
sanitize_anchor_nameremoves unsafe characters from heading-derived anchor values, andhtml_escape_onceescapes the text displayed in the TOC.
Tested with Chrome, Safari, and Firefox on macOS. The related tests pass.
Updated by Go MAEDA about 5 hours ago
- Category set to Text formatting
- Status changed from New to Confirmed
- Target version set to 7.0.4
Updated by Go MAEDA about 5 hours ago
- Related to Patch #44711: Update Rails to 8.1.4.1 added
Updated by Go MAEDA about 4 hours ago
- Status changed from Confirmed to Resolved
- Assignee set to Go MAEDA
- Resolution set to Fixed
Committed the fix in r25434. Thank you.