Merge pull request #466 from chuenchen309/fix/link-dest-backslash-non-punctuation

Only treat a backslash as an escape before punctuation in a link destination

Author: lepture

src/mistune/helpers.py

@@ -146,7 +146,7 @@ def parse_link_href(src: str, start_pos: int, block: bool = False) -> Union[Tupl
             break
         if c == "\x00":
             return None, None
-        if c == "\\":
+        if c == "\\" and pos + 1 < len(src) and src[pos + 1] in string.punctuation:
             pos = min(pos + 2, len(src))
             continue
         if not block:

tests/test_misc.py

@@ -91,6 +91,19 @@ def test_harmful_links(self):
         expected = '<p><a href="#harmful-link">h</a></p>'
         self.assertEqual(result.strip(), expected)
 
+    def test_backslash_space_in_link_destination_is_not_an_escape(self):
+        # A space is not ASCII punctuation, so "\ " is a literal backslash and a
+        # space that ends the bare destination: the link fails to parse and is
+        # rendered as text (as CommonMark and other parsers do). Previously the
+        # scanner treated "\ " as an escape and swallowed the space into the URL,
+        # producing an illegal href containing %5C%20.
+        result = mistune.html(r"[a](foo\ bar)")
+        self.assertEqual(result.strip(), r"<p>[a](foo\ bar)</p>")
+
+        # An escaped punctuation character is still consumed as an escape.
+        result = mistune.html(r"[a](foo\*bar)")
+        self.assertEqual(result.strip(), '<p><a href="foo*bar">a</a></p>')
+
     def test_harmful_links_variants(self):
         # entity-decoded, alternate-scheme, and reference-link forms are all
         # routed to the #harmful-link sentinel.