Skip to content

[markdown] AutolinkExtensionSyntax double-encodes percent-encoded sequences in the destination #2479

Open

Description

@TsubasaYoshida

When the GFM extended autolink syntax parses a bare URL that already contains percent-encoded sequences, the generated href gets double-encoded.

import 'package:markdown/markdown.dart';

void main() {
  print(markdownToHtml(
    'https://example.com/%40foo',
    extensionSet: ExtensionSet.gitHubFlavored,
  ));
}

Actual:

<p><a href="https://example.com/%2540foo">https://example.com/%40foo</a></p>

Expected (matches inline links and cmark-gfm's autolink output):

<p><a href="https://example.com/%40foo">https://example.com/%40foo</a></p>

The inline link form [text](https://example.com/%40foo) already produces the expected output, because normalizeLinkDestination leaves pre-existing percent-encoding alone per https://spec.commonmark.org/0.30/#example-502.

Cause: AutolinkExtensionSyntax.onMatch builds the href with Uri.encodeFull(destination), which escapes % itself, turning %40 into %2540. As a result, bare URLs whose path or query already contains percent-encoded characters link to a wrong destination.

I have a fix ready and will open a PR shortly.

Activity

  1. added
    type-bugIncorrect behavior (everything from a crash to more subtle misbehavior)
    on Aug 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    package:markdowntype-bugIncorrect behavior (everything from a crash to more subtle misbehavior)

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions