Relationship Graph

Relationship Graph
related to related to child of child of duplicate of duplicate of

View Issue Details

IDProjectCategoryView StatusLast Update
0034389mantisbtmarkdownpublic2026-10-08 05:34
Reporterdregad Assigned Tocommunity  
PrioritynormalSeverityminorReproducibilityalways
Status assignedResolutionopen 
Target Version2.29.0 
Summary0034389: Broken rendering of links in <a href=... links when markdown is enabled
Description

Following merge of PR 1976 to fix 0034040, <a href... links are not rendered as expected when Markdown is enabled and process_url = ON (see attached image.png).

<a href="https://example.com">Link</a>

<a href="https://example.com">Link</a>

Following analysis by @hotzeplotz this is likely caused by a bug in Parsedown.

Additional Information

See original discussion in PR 1976
https://github.com/mantisbt/mantisbt/pull/1976#issuecomment-2030712795

TagsNo tags attached.
Attached Files
image.png (10,730 bytes)   
image.png (10,730 bytes)   

Relationships

related to 0034040 closedcommunity Markdown processing code cleanup (part 2) 

Activities

hotzeplotz

hotzeplotz

2024-04-02 17:42

reporter   ~0068779

Last edited: 2024-04-03 03:54

Caused by the regex used by the inlineUrl method. https://github.com/erusev/parsedown/blob/1ff038273949df7d6a455352659a878f3c89b29c/Parsedown.php#L1540

if (strpos($Excerpt['context'], 'http') !== false
    and preg_match('/\bhttps?+:[\/]{2}[^\s<]+\b\/*+/ui', $Excerpt['context'], $matches, PREG_OFFSET_CAPTURE)                                                          
)

The regex fail is the boundery " is not followd by a whitespace. href="…"> fail, while href="" > works.

Fail: https://regex101.com/r/kabj3Q/1

Possible fix

https://regex101.com/r/5h5eLe/1

/\bhttps?+:[\/]{2}[^\s<"]+\b\/*+/ui'
                       ^ Adding a " here

It is possible that the other regular expressions for the links also have such a problem … just uncovered.

hotzeplotz

hotzeplotz

2024-04-02 17:45

reporter   ~0068780

Last edited: 2024-04-03 06:45

side note, the textarea needs a nice monospace font, to enable the reporter to place some markings to the right position :-)

hotzeplotz

hotzeplotz

2024-04-02 17:51

reporter   ~0068781

parsedown-html-anchorr-fix.png (30,574 bytes)   
parsedown-html-anchorr-fix.png (30,574 bytes)   
parsedown-html-anchor-fail.png (34,288 bytes)   
parsedown-html-anchor-fail.png (34,288 bytes)   
hotzeplotz

hotzeplotz

2026-10-05 07:29

reporter   ~0071483

Hello Damien, I am sorry for being so silent for so long. Other issues in my life need my attention.

I gave my word that I would take responsibility for this part, and that still stands.

You can ping me on any reated issue, such as 0036438.

Do we still want the result of https://regex101.com/r/5h5eLe/1 (screenshot above parsedown-html-anchor-fix.png)?

dregad

dregad

2026-10-05 08:30

developer   ~0071484

sorry for being so silent for so long. Other issues in my life need my attention

Hello, no worries - trust me I know what it's like...
To be honest I even forgot about this issue, because I almost never paste HTML links, I generally just use plain URLs or markdown ;-)

Do we still want the result of https://regex101.com/r/5h5eLe/1

Yes, I believe this is the correct rendering.

hotzeplotz

hotzeplotz

2026-10-05 10:26

reporter   ~0071485

Last edited: 2026-10-05 11:27

My name is Stefan :)

PR https://github.com/mantisbt/mantisbt/pull/2296

dregad

dregad

2026-10-08 04:47

developer   ~0071491

Last edited: 2026-10-08 05:34

Well met Stefan :-)

Thanks for the PR.

Since this bug is reproducible in plain Parsedown if Safe Mode or Escape Markup are enabled (of course URL links must be ON as well), independently from your proposed patch as demonstrated by the code snippet below, I think I'll report it upstream too, so when it's fixed we can remove the override of inlineUrl() method.

include 'Parsedown.php';
$p = new Parsedown;
$p->setUrlsLinked(true);
$p->setSafeMode(true); // OR $p->setMarkupEscaped(true);
echo $p->text('<a href="http://example.com">link</a>');
// <p><a href="<a href="http://example.com">link">http://example.com">link</a></a></p>
// Expected:
//  <p><a href="<a href="http://example.com">http://example.com</a>">link</a></p>