1

Edit: My assumptions about encoding were incorrect. I'm leaving the question as originally asked in case others come here with the same misunderstanding.

When I include a link in some text in the editor that includes a querystring, then view the source code, I can see that it's converted any & characters in the href to &, which breaks the links.

<a href="/foo?one=1&two=2">A link</a>

becomes

<a href="/foo?one=1&amp;two=2">A link</a>

and if I change it back to just & in the source, click Ok on the view source dialog, then immediately view source again, it's already worked its charms and encoded the & once again.

Is there a way to cue the editor to go ahead and convert those outside tag attributes, but not mess with those in attributes?

Using an older version (4.0.12), but I see the behavior on the current live sample right on tinymce.com, so if it's a bug it looks like it hasn't been fixed. But I am wondering if it's just a setting I'm missing.

Relevant questions:

Do I encode ampersands in <a href...>?

Do ampersands still need to be encoded in URLs in HTML5?

jinglesthula
  • 4,446
  • 4
  • 45
  • 79
  • In my testing a browser will properly render that link even with the ampersand as its entity. If browsers can render/follow the link what issue are you trying to address? – Michael Fromin Apr 30 '18 at 01:11
  • @MichaelFromin I believe the specific case reported to us was when the link was rendered in a PDF it wasn't working. The main issue is that it happens at all. The characters within quotes for an attribute shouldn't be modified. That some consumers of the output make assumptions about what was meant is orthogonal to the editor's encoding coloring outside the lines, so to speak. – jinglesthula Apr 30 '18 at 17:23
  • @MichaelFromin When I test such a link, the server sees the keys in the querystring key value pairs as `one` and `amp;two`. Anything looking for the key `two` will fail. While rendering the link isn't failing outright, and the browser can follow it to the page, the querystring itself isn't working, at least in my testing. I'm using Chrome 66, but other browsers may actually modify the URL as it's either rendered or followed as a guess at the intent. For this reason, I think it's important to disconsider the consumption of the content and only worry about the editor behavior. – jinglesthula Apr 30 '18 at 17:25
  • The HTML spec actually states that ampersands in HTML attributes have to be encoded so TinyMCE is working 100% as it should. If your server side code is not handling that correctly that is an issue with the server side code. – Michael Fromin May 01 '18 at 15:36
  • @MichaelFromin after looking a bit more, I see you are spot on. I'm going to delete the question and close the related issue on the project on github. Thanks. – jinglesthula May 01 '18 at 15:52
  • I would leave the question -- I suspect others don't know this fact and this question would be useful. Perhaps accept my answer as correct for future people's knowledge. – Michael Fromin May 01 '18 at 15:55
  • Gotcha - I like that even better :) – jinglesthula May 01 '18 at 15:57

1 Answers1

2

The HTML spec actually states that ampersands in HTML attributes have to be encoded so TinyMCE is working 100% as it should. If your server side code is not handling that correctly that is an issue with the server side code.

Michael Fromin
  • 13,131
  • 2
  • 20
  • 31