Wrong trailing semicolon on URL

[tafli]

Bug Description

I recognized this behavior when sharing CURL-Request.

When sending a URL with a trailing '/' or sub path and trailing single quote ('), the text appears with an additional ; at the end in Threema-Web. On a mobile app (tested on Android only), the text appears correctly.

Examples:
'foo.bar -> 'foo.bar
'foo.bar' -> 'foo.bar'
'foo.bar/' -> 'foo.bar/';
'foo.bar/x' -> 'foo.bar/x';

The leading ' doesn't need to exist. foo.bar/x' has the same effect.

It also works, when trailing the ' with additional ;. In this case a ; is added as well:
foo.bar/x';;; -> foo.bar/x';;;;

Using the copy function, the correct text is copied without the trailing ;.

Steps to Reproduce (for bugs)

Send following text: foo.bar/x'

Expected behaviour

Sent text is shown correctly.

Your Environment

• Threema Web version: 2.4.1

[bratkartoffel]

Can reproduce this issue using Firefox 101.0.1 and MS Edge 102.0.1245.39

[threema-danilo]

Confirmed. This is an interaction between HTML escaping and the linkify filter... The text first gets converted into foo.bar/x' then into <a href="http://foo.bar/x&#039" class="autolinked autolinked-url" target="_blank" rel="noopener noreferrer">foo.bar/x&#039</a>;.

[threema-danilo]

Hmm, this one is tricky. We generally want to do HTML escaping first, before applying other filters. However, this causes some issues with autolinker, see gregjacobs/Autolinker.js#197. I can't yet promise a quick solution, especially since you are the first person that reports this issue in the 5 years since it was released 🙂 If someone has a good idea of how to solve this, PRs are welcome.