ngSanitize linky filter incorrectly converts query key html entities to entity numbers.

[KurtWagner]

URL query parameters like &center= have the &cent part converted to ¢, which results in ¢er=

For example:

'http://test.com/?arg=10&quote=10&center=10' | linky

Becomes

<a href="http://test.com/?arg=10&#34;e=10&#162;er=10">http://test.com/?arg=10&amp;quote=10&amp;center=10</a>

i.e, a link of

http://test.com/?arg=10"e=10¢er=10

See jsfiddle. Similar issue when using ngBindHtml (jsfiddle). So I'm guessing it all comes down to $sanitize (jsfiddle)

[gkalpak]

A little "background" for anyone looking into it:
It's indeed $sanitize and more specifically the decodeEntities() function.

decodeEntities() uses a hidden element to decode entities: It sets the possibly encoded string as the hidden element's HTML, let's the browser decode entities and reads it back as text.

Apparently, for backwards compatibility reasons, HTML entities (at least some of them) are allowed to not have a trailing semicolon. So, for example &center is equivalent to ¢er etc.

Although not directly related, this article contains relevant info and references.

[caitp]

I was thinking we could use URLUtils or an anchor's href attribute rather than the pre, when dealing with URLs.

But there's a problem! (derp). https://www.w3.org/Bugs/Public/show_bug.cgi?id=26431 there's some unspecified and non-interop behaviour which breaks a few tests when done this way :(

[caitp]

I think ngSanitize is due for a rewrite.

The trouble is, right now it's really non-flexible, and it's hard to introduce flexibility here without also exponentially increasing complexity, and likely breaking many other parts.

I think it would be worth figuring out the various threats that ngSanitize is meant to protect against, and make it deal with those specifically, without breaking usability

[kevinrenskers]

This is a huge issue for us. We have a chat application and now sometimes the links in messages simply don't work anymore. Users are unhappy and we don't really see a workaround. Is there anything we can do short term to solve this problem, short of disabling SCE altogether?

[richterb]

What's the status on this issue? I can't even figure out a workaround in the meantime, apart from rewriting my own linky filter (ergh)

[lorenzhs]

This just crept up for us again (Glowing Bear, an IRC web frontend), and just like for @kevinrenskers it's a big deal for us as well. Multiple users have run into that issue now. Is there anything we can do about it?