diff --git a/THANKS b/THANKS index 73210de..ecfcb0e 100644 --- a/THANKS +++ b/THANKS @@ -1,6 +1,6 @@ People who contributed code and fixed bugs: -- Changaco +- Changaco - vmg - heintz - honza @@ -10,3 +10,4 @@ People who contributed code and fixed bugs: - lepture - sprin - graphicore +- samuelcolvin diff --git a/misaka/api.py b/misaka/api.py index 4d57e89..57c4bd4 100644 --- a/misaka/api.py +++ b/misaka/api.py @@ -342,7 +342,7 @@ def link(self, content, raw_url, title=''): url = self.rewrite_url(raw_url) maybe_title = ' title="%s"' % escape_html(title) if title else '' url = escape_html(url) - return ('' + content + '') % (url, maybe_title) + return ('' % (url, maybe_title)) + content + '' else: return escape_html("[%s](%s)" % (content, raw_url)) diff --git a/tests/test_xss_protection.py b/tests/test_xss_protection.py index e422668..6428ff0 100644 --- a/tests/test_xss_protection.py +++ b/tests/test_xss_protection.py @@ -126,3 +126,9 @@ def test_image_src_rewriting(self): actual = render_rewrite('![](http:"foo")') expected = '
\n' ok(actual).diff(expected) + + def test_bug_pyformat_in_content(self): + # See: https://github.com/FSX/misaka/issues/66 + actual = render('[![xxx](http://www.example.com/?v=%s)](http://www.example.com/])') + expected = '\n' + ok(actual).diff(expected)