Merge pull request #295 from dairiki/bug.escape_url

Mistune.util.escape_url is too aggressive
lepture · Jan 14, 2022 · babb0cf · babb0cf
2 parents 3e8d352 + fc2cd53
commit babb0cf
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/mistune/util.py b/mistune/util.py
@@ -20,7 +20,12 @@ def escape(s, quote=True):
 
 
 def escape_url(link):
-    safe = '/#:()*?=%@+,&'
+    safe = (
+        ':/?#@'           # gen-delims - '[]' (rfc3986)
+        '!$&()*+,;='      # sub-delims - "'" (rfc3986)
+        '%'               # leave already-encoded octets alone
+    )
+
     if html is None:
         return quote(link.encode('utf-8'), safe=safe)
     return html.escape(quote(html.unescape(link), safe=safe))