element-hq / element-hq/element-web

Linkify incorrectly includes trailing U+2066 and presumably other non-printing unicode in URLs

Open
#30,351 0 comments 0 reactions 0 assignees View on GitHub
A-URL-Previews O-Uncommon S-Minor T-Defect Z-Upstream
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

1. Copy-paste a URL and accidentally append some non-printing unicode (e.g. a U+2066 LTR ISOLATE codepoint), sending it as plain text from a Matrix client like EX.
2. EW spots the URL and linkifies it
3. But linkify includes the non-printing sequence as part of the URL

For instance:

`https://example.com/⁦` (which includes an invisible U+2066 on the end)

gets linkified to be

https://example.com/%E2%81%A6

causing mass confusion

### Outcome

#### What did you expect?

Linkify's regexp should not pick up random non-printing unicode on the end of URLs.

#### What happened instead?

chaos

### Operating system

macOS

### Browser information

_No response_

### URL for webapp

_No response_

### Application version

Element Nightly version: 2025072101 Crypto version: Rust SDK 0.12.0 (b30f1f3), Vodozemac 0.9.0

### Homeserver

matrix.org

### Will you send logs?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.