[PATCH] Minor correction of AUTO_LINK_RE

PATCH for AUTO_LINK_RE

I'm not sure if the autolink method is supposed to work with HTML; using it after html_escape should be safer.

Anyway, that Regexp is buggy in more places.

  (                          # leading text
    <\w+.*?>|                # leading HTML tag, or
    [^=!:'"/]|               # leading punctuation, or 
    ^                        # beginning of line
  )

The first option only matches single-line tags, so .*? should probably be (?m:.*?). The second option disallows some leading punctation, and allows everything else (especially white space), so that comment is misleading.

In the line dim pointed out:

  (?:/(?:(?:[~\w\+@%-]|(?:[,.;:][^\s$]))+)?)*
                   what's this? ----^

Someone apparently wanted to say "punctation only if not followed by whitespace or the end of the string", but $ matches just the dollar sign inside [ ].

Using (?!\s|<|$) or something seems more appropriate to me as it doesn't eat the "check" character. This avoids problems with texts like "www.rubyonrails.org/.&a=b", where the & would get eaten by the path sub-regexp.

To avoid mathing the punctation in "www.rubyonrails.org/..." or "www.rubyonrails.org/?!", we can use [[:punct:]]+ with atomic matching:

  (?:/(?:(?:[~\w\+@%-]|(?:(?>[[:punct:]]+)(?!\s|<|$)))+)?)* # path

But that still doesn't help us with strings like this:

  <optgroup label="Subdomains of www.rubyonrails.org">

which would still produce invalid HTML when auto_link'd.

I'd leave the priority on "high", and if a solution is found, would like to see it in 1.2 also, because this is exactly the kind of bug that XSS hackers use.

+1

As stated in the description of report {68}, the 2.0 milestone should only be used by core members for real show stoppers.

for rails at 6f20efdaf733db26fbf337da73121983785064d5

+1