Do not remove anchors in safe_mode

trentm · Jan 15, 2018 · 5f3aa2b · 5f3aa2b
1 parent 7589544
commit 5f3aa2b
Show file tree

Hide file tree

Showing 5 changed files with 26 additions and 1 deletion.
diff --git a/lib/markdown2.py b/lib/markdown2.py
@@ -1406,7 +1406,8 @@ def _do_links(self, text):
                         curr_pos = start_idx + len(result)
                         text = text[:start_idx] + result + text[url_end_idx:]
                     elif start_idx >= anchor_allowed_pos:
-                        if self.safe_mode and not self._safe_protocols.match(url):
+                        safe_link = self._safe_protocols.match(url) or url.startswith('#')
+                        if self.safe_mode and not safe_link:
                             result_head = '<a href="#"%s>' % (title_str)
                         else:
                             result_head = '<a href="%s"%s>' % (_html_escape_url(url, safe_mode=self.safe_mode), title_str)

diff --git a/test/tm-cases/link_safe_urls.html b/test/tm-cases/link_safe_urls.html
@@ -0,0 +1,11 @@
+<p><a href="https://www.example.com">Safe link 1</a></p>
+
+<p><a href="http://www.example.com">Safe link 2</a></p>
+
+<p><a href="ftp://www.example.com">Safe link 3</a></p>
+
+<p><a href="#anchor">Safe link 4</a></p>
+
+<p><a href="#">Unsafe link 1</a></p>
+
+<p><a href="#">Unsafe link 2</a></p>
diff --git a/test/tm-cases/link_safe_urls.opts b/test/tm-cases/link_safe_urls.opts
@@ -0,0 +1 @@
+{"safe_mode": "escape"}
diff --git a/test/tm-cases/link_safe_urls.tags b/test/tm-cases/link_safe_urls.tags
@@ -0,0 +1 @@
+safe_mode
diff --git a/test/tm-cases/link_safe_urls.text b/test/tm-cases/link_safe_urls.text
@@ -0,0 +1,11 @@
+[Safe link 1](https://www.example.com)
+
+[Safe link 2](http://www.example.com)
+
+[Safe link 3](ftp://www.example.com)
+
+[Safe link 4](#anchor)
+
+[Unsafe link 1](unknown://www.example.com)
+
+[Unsafe link 2](example)