Skip to content

fix: do not start a www autolink right after < - #4118

Open
breken-ai wants to merge 2 commits into
markedjs:masterfrom
breken-ai:fix/www-autolink-after-angle
Open

breken-ai wants to merge 2 commits into
markedjs:masterfrom
breken-ai:fix/www-autolink-after-angle

Conversation

@breken-ai

Copy link
Copy Markdown
Contributor

Marked version: 18.0.14 (master at 4ee44f7)

Markdown flavor: GitHub Flavored Markdown

Description

No existing issue that I could find.

Expectation

<www.example.com> is not a CommonMark autolink (it has no scheme), and GFM does not start a www autolink after <. The extended autolink section says they "can only come at the beginning of a line, after whitespace, or any of the delimiting characters *, _, ~, and (". GitHub renders it as plain text:

<p>Copyright OpenJS Foundation and other contributors, &lt;www.openjsf.org&gt;</p>

(That line is from the ESLint README.)

Result

<p>Copyright OpenJS Foundation and other contributors, &lt;<a href="http://www.openjsf.org%3E">www.openjsf.org&gt;</a></p>

The link text and the href both take in the closing >, so the link points at http://www.openjsf.org%3E, which does not load. Anyone who wraps a bare www address in angle brackets, the usual way to write a URL in a license or contact line, gets a dead link.

What was attempted

The GFM text rule stops before every www., so the url tokenizer ran on it even when < came right before. The fix makes the text rule consume <www. as text, which matches GitHub. It leaves <www. alone when an email address follows (<www.foo@bar.com> is still an email autolink), and it does not touch real autolinks (<https://example.com>, <foo@example.com>) or www links after whitespace or (.

Test: test/specs/new/autolink_www_after_angle.md, with the expected HTML taken from GitHub's markdown API. It fails on master and passes with the fix. npm run test:specs (1865/1865), test:unit, test:cjs, test:umd, test:types and test:lint all pass. I also compared this branch with master on 100k generated GFM inputs, with and without breaks. The only outputs that changed have a www. right after <, and the ones I spot-checked against GitHub's renderer now match it.

This change was prepared with the help of an AI coding assistant, and I reviewed and tested it.

Contributor

  • Test(s) exist to ensure functionality and minimize regression (if no tests added, list tests covering this PR); or,
  • no tests required for this PR.
  • If submitting new feature, it has been documented in the appropriate places.

Committer

In most cases, this should be a different person than the contributor.

GFM starts a www autolink only at the start of a line, after whitespace
or after *, _, ~ or (. marked started one after <, so text such as
<www.example.com> became a link whose text and href swallowed the
closing >, pointing at http://www.example.com%3E. GitHub renders it as
plain text.

Treat <www. as text unless an email address follows.
@vercel

vercel Bot commented Sep 30, 2026

Copy link
Copy Markdown

@breken-ai is attempting to deploy a commit to the MarkedJS Team on Vercel.

A member of the Team first needs to authorize it.

@vercel

vercel Bot commented Sep 30, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
marked-website Ready Ready Preview Oct 8, 2026 6:37am UTC

Request Review

Comment thread test/specs/new/autolink_www_after_angle.md Outdated

@UziTech UziTech left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

This branch was successfully deployed

1 active deployment
Preview — 25333f0b Deployed Oct 8, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants