Change Details

It used to be possible to have monospace links by using the ##[[ uri | `free text` ]]## syntax, but this is no longer possible since https://secure.phabricator.com/D20937 / https://hackerone.com/reports/758002 / rP54bcbdaba94a). I think it was never intentionally allowed, and there was never a test for it. It is (or was) useful a used feature, so I (avivey) think we should restore it. D20937 stops parsing either side (uri and text) as remarkup to prevent xss stuff. It's not clear to me if there's an actual security risk in allowing remarkup in the text side. Possible paths forward: 1. Do a proper xss analysis about allowing remarkup in the text portion of the link, and if we're convinced it's fine, just enable it. 2. Special-case hack the link syntax to understand backquotes in the text section. This has some obvious limitations, like allowing mixed-format text. 3. making the test in PhutilRemarkupDocumentLinkRule more fine-grained, to allow some forms of markup. This might be expensive in performance (see https://secure.phabricator.com/T2849).

It used to be possible to have monospace links by using this syntax with backticks: ##[[ uri | `free text` ]]## , but this is no longer possible since: - https://secure.phabricator.com/D20937 - https://hackerone.com/reports/758002 - rP54bcbdaba94a I think it was never intentionally allowed, and there was never a test for it. It is (or was) useful a used feature, so I (avivey) think we should restore it. The patch [[ https://secure.phabricator.com/D20937 | D20937 ]] stops parsing either side (uri and text) as remarkup to prevent XSS issues. It's not clear to me if there's an actual security risk in allowing remarkup in the text side. Possible paths forward: 1. Do a proper XSS analysis about allowing remarkup in the text portion of the link, and if we're convinced it's fine, just enable it. 2. Special-case hack the link syntax to understand backquotes in the text section. This has some obvious limitations, like allowing mixed-format text. 3. making the test in PhutilRemarkupDocumentLinkRule more fine-grained, to allow some forms of markup. This might be expensive in performance (see https://secure.phabricator.com/T2849).

It used to be possible to have monospace links by using thethis syntax with backticks: ##[[ uri | `free text` ]]## syntax, but this is no longer possible since: - https://secure.phabricator.com/D20937 / - https://hackerone.com/reports/758002 / - rP54bcbdaba94a). I think it was never intentionally allowed, and there was never a test for it. It is (or was) useful a used feature, so I (avivey) think we should restore it. The patch [[ https://secure.phabricator.com/D20937 | D20937 ]] stops parsing either side (uri and text) as remarkup to prevent xss stuffXSS issues. It's not clear to me if there's an actual security risk in allowing remarkup in the text side. Possible paths forward: 1. Do a proper xssXSS analysis about allowing remarkup in the text portion of the link, and if we're convinced it's fine, just enable it. 2. Special-case hack the link syntax to understand backquotes in the text section. This has some obvious limitations, like allowing mixed-format text. 3. making the test in PhutilRemarkupDocumentLinkRule more fine-grained, to allow some forms of markup. This might be expensive in performance (see https://secure.phabricator.com/T2849).