"Mailto" links without "to" field are stripped off

This works correctly:

[my link](mailto:alice@alice.com&subject=Hi)

This doesn’t work (an empty <a> tag is generated):

[my link](mailto:&subject=Hi)

The later formatting allows a user to send a message to whoever he wants. It is used in Discourse, for example, when sharing a post (see the code here).


Same issue with the email bbcode. This works correctly:

[email=alice@alice.com&subject=Hi]my link[/email]

But not this:

[email=&subject=Hi]my link[/email]
1 Like

Weird it works on plain markdown-it and on commonmark dingus, so I guess it’s an spec violation.


Most likely related to our sanitizer, I am guessing we are stripping due to a potential security issue. Maybe a bit too aggressively.

I support a fix here but it is likely to be very very tricky.