fix: encode URL by default

lib/renderer.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const { inherits } = require('util');
 const marked = require('marked');
 const stripIndent = require('strip-indent');
 const { stripHTML, highlight, slugize, encodeURL, url_for } = require('hexo-util');
@@ -12,7 +13,7 @@ function Renderer() {
   this._headingId = {};
 }
 
-require('util').inherits(Renderer, MarkedRenderer);
+inherits(Renderer, MarkedRenderer);
 
 // Add id attribute to headings
 Renderer.prototype.heading = function(text, level) {
@@ -41,26 +42,16 @@ function anchorId(str, transformOption) {
 // Support AutoLink option
 Renderer.prototype.link = function(href, title, text) {
   if (this.options.sanitizeUrl) {
-    let prot;
-
-    try {
-      prot = decodeURIComponent(unescape(href))
-          .replace(/[^\w:]/g, '')
-          .toLowerCase();
-    } catch (e) {
-      return '';
-    }
-
-    if (prot.startsWith('javascript:') || prot.startsWith('vbscript:') || prot.startsWith('data:')) {
-      return '';
+    if (href.startsWith('javascript:') || href.startsWith('vbscript:') || href.startsWith('data:')) {
+      href = '';
     }
   }
 
   if (!this.options.autolink && href === text && title == null) {
     return href;
   }
 
-  let out = `<a href="${href}"`;
+  let out = `<a href="${encodeURL(href)}"`;
 
   if (title) {
     out += ` title="${title}"`;

package.json

@@ -28,8 +28,7 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "hexo": "^4.0.0",
-    "hexo-util": "^1.3.0",
+    "hexo-util": "^1.5.0",
     "marked": "^0.7.0",
     "strip-indent": "^3.0.0"
   },

test/index.js

@@ -1,7 +1,7 @@
 'use strict';
 
-const should = require('chai').should(); // eslint-disable-line
-const util = require('hexo-util');
+require('chai').should();
+const { highlight, encodeURL } = require('hexo-util');
 
 describe('Marked renderer', () => {
   const ctx = {
@@ -31,7 +31,7 @@ describe('Marked renderer', () => {
 
     result.should.eql([
       '<h1 id="Hello-world"><a href="#Hello-world" class="headerlink" title="Hello world"></a>Hello world</h1>',
-      '<pre><code>' + util.highlight(code, {gutter: false, wrap: false}) + '</code></pre>',
+      '<pre><code>' + highlight(code, {gutter: false, wrap: false}) + '</code></pre>',
       '<h2 id="Hello-world-1"><a href="#Hello-world-1" class="headerlink" title="Hello world"></a>Hello world</h2>',
       '<p>hello</p>'
     ].join('') + '\n');
@@ -97,6 +97,23 @@ describe('Marked renderer', () => {
     result.should.eql('<p>Description Term<br>:This is the Description</p>\n');
   });
 
+  it('should encode URL properly', () => {
+    const urlA = '/foo/bár.jpg';
+    const urlB = 'http://fóo.com/bar.jpg';
+
+    const body = [
+      `[foo](${urlA})`,
+      `[bar](${urlB})`
+    ].join('\n');
+
+    const result = r({text: body});
+
+    result.should.eql([
+      `<p><a href="${encodeURL(urlA)}">foo</a>`,
+      `<a href="${encodeURL(urlB)}">bar</a></p>\n`
+    ].join('\n'));
+  });
+
   describe('autolink option tests', () => {
     const ctx = {
       config: {
@@ -119,8 +136,8 @@ describe('Marked renderer', () => {
       const result = r({text: body});
 
       result.should.eql([
-        '<p>Great website <a href="http://hexo.io">http://hexo.io</a></p>\n',
-        '<p><a href="http://hexo.io">Hexo</a></p>\n'
+        '<p>Great website <a href="http://hexo.io/">http://hexo.io</a></p>\n',
+        '<p><a href="http://hexo.io/">Hexo</a></p>\n'
       ].join(''));
     });
 
@@ -131,7 +148,7 @@ describe('Marked renderer', () => {
 
       result.should.eql([
         '<p>Great website http://hexo.io</p>\n',
-        '<p><a href="http://hexo.io">Hexo</a></p>\n'
+        '<p><a href="http://hexo.io/">Hexo</a></p>\n'
       ].join(''));
     });
   });
@@ -247,9 +264,12 @@ describe('Marked renderer', () => {
   });
 
   it('should encode image url', () => {
+    const urlA = '/foo/bár.jpg';
+    const urlB = 'http://fóo.com/bar.jpg';
+
     const body = [
-      '![](/foo/bár.jpg)',
-      '![](http://fóo.com/bar.jpg)'
+      `![](${urlA})`,
+      `![](${urlB})`
     ].join('\n');
 
     const renderer = require('../lib/renderer');
@@ -258,8 +278,8 @@ describe('Marked renderer', () => {
     const result = r({text: body});
 
     result.should.eql([
-      '<p><img src="/foo/b%C3%A1r.jpg" alt="">',
-      '<img src="http://xn--fo-5ja.com/bar.jpg" alt=""></p>\n'
+      `<p><img src="${encodeURL(urlA)}" alt="">`,
+      `<img src="${encodeURL(urlB)}" alt=""></p>\n`
     ].join('\n'));
   });
 });