Linky filter ignores invalid URL characters

[dchacke]

I tried to parse links in a string and I noticed that the links got way too long because they only ever stopped when a space was encountered. In my case, they should have stopped earlier at an escaped quote (\"), but I suppose there should be other special characters that properly delimit a URL from the rest of the string.

• Reproducible: Sometimes (with text that contains links and delimits them with characters that are not URL safe)
• Browsers: Chrome 47.0.2526.106 (64-bit), Safari version 9.0 (11601.1.56)
• Operating system: OS X El Capitan 10.11
• Angular version: 1.4.7
• Potential location of issue: https://github.com/angular/angular.js/blob/master/src/ngSanitize/filter/linky.js#L134
• Example/how to reproduce: https://regex101.com/r/zV5zJ4/6

This example includes my specific case where I tried to parse some stringified JSON and the recognized link is too long. I also put some special characters in there that should not be allowed, which I base on http://stackoverflow.com/a/1547940/1371131.

I parsed the text using the following expression:

<pre><code ng-bind-html="object | json | linky: '_blank'"></code></pre>

Forgive me if my reproduction of the regex is wrong. I haven't used regexes much, nor do I know much about the exact regex format URLs need to follow, so take it with a grain of salt. The issue I encountered seemed weird though.

[Narretz]

Thanks for the detailed explanation. The linky regex is currently pretty weak. The thing is that I'm not sure if \ is really disallowed. The same SO question has an answer where it is said, that \ is "unwise" but not forbidden. In any case, I don't really want to complicate the linky regex too much .... I wonder what @gkalpak's opinion is on this, he has recently dealt with the mail regex.

[gkalpak]

Yes, the LINKY_URL_REGEXP seems pretty broken. Not sure how much of it can be fixed without breaking existing apps. I'll look into it some more...