# Onebox codifica le virgolette singole nell'URL rompendo il link
**URL:** https://meta.discourse.org/t/onebox-encodes-single-quotes-in-url-breaking-the-link/115947
**Category:** Bug
**Created:** [25 Aprile 2019, 11:04am UTC](https://meta.discourse.org/t/onebox-encodes-single-quotes-in-url-breaking-the-link/115947 "2019-04-25T11:04:43Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [25 Aprile 2019, 11:04am UTC](https://meta.discourse.org/t/onebox-encodes-single-quotes-in-url-breaking-the-link/115947/1 "2019-04-25T11:04:43Z")
Onebox [encodes](https://github.com/discourse/onebox/blob/79033b8520ad06606f87f69b3579cae0e6761fff/lib/onebox/engine.rb#L85) the single quote (`'`) to `'` in URL, and in some cases breaks the link. Example:
[https://doomwiki.org/wiki/Musical\_inspirations\_behind\_Doom’s\_music](https://doomwiki.org/wiki/Musical_inspirations_behind_Doom's_music)
> [https://doomwiki.org/wiki/Musical\_inspirations\_behind\_Doom’s\_music](https://doomwiki.org/wiki/Musical_inspirations_behind_Doom's_music)
The encoding is done as preventive measure against XSS attacks. I am not sure if we should let single quotes pass through in URL as it is a rare edge case. Thoughts?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [26 Aprile 2019, 12:18am UTC](https://meta.discourse.org/t/onebox-encodes-single-quotes-in-url-breaking-the-link/115947/2 "2019-04-26T00:18:03Z")
Do you think this change would be safe @sam?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [26 Aprile 2019, 12:51am UTC](https://meta.discourse.org/t/onebox-encodes-single-quotes-in-url-breaking-the-link/115947/3 "2019-04-26T00:51:55Z")
We should follow the spec here with our encoding. Technically I think we got to allow stuff like `(` and `)` through cause wikipedia can use that. Even `&` is allowed according to spec eg: `https://en.wikipedia.org/wiki/&`
see: [https://stackoverflow.com/a/4669755/17174](https://stackoverflow.com/a/4669755/17174)
> **[RFC 3986: Uniform Resource Identifier (URI): Generic Syntax](https://datatracker.ietf.org/doc/html/rfc3986)**
>
> A Uniform Resource Identifier (URI) is a compact sequence of characters that identifies an abstract or physical resource. This specification defines the generic URI syntax and a process for resolving URI references that might be in relative form,...
I guess we need one rule for encoding the query params and another for encoding the path.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [26 Aprile 2019, 1:27am UTC](https://meta.discourse.org/t/onebox-encodes-single-quotes-in-url-breaking-the-link/115947/4 "2019-04-26T01:27:57Z")
> [@sam](#):
>
> I guess we need one rule for encoding the query params and another for encoding the path.
Yes this part is rather important @techAPJ
---
### Author:  [@lionel-rowe](https://meta.discourse.org/u/lionel-rowe)
#### Post date: [26 Aprile 2019, 8:24am UTC](https://meta.discourse.org/t/onebox-encodes-single-quotes-in-url-breaking-the-link/115947/6 "2019-04-26T08:24:53Z")
FWIW, percent encoding:
[https://doomwiki.org/wiki/Musical\_inspirations\_behind\_Doom's\_music](https://doomwiki.org/wiki/Musical_inspirations_behind_Doom%27s_music)
`https://doomwiki.org/wiki/Musical_inspirations_behind_Doom%27s_music`
Works fine (even though `'` isn’t percent encoded per the spec). I’m not aware of a situation where HTML entities should be used anywhere in a URL, even in query params.
---
### Author:  [@Dannii](https://meta.discourse.org/u/Dannii)
#### Post date: [26 Aprile 2019, 2:59pm UTC](https://meta.discourse.org/t/onebox-encodes-single-quotes-in-url-breaking-the-link/115947/7 "2019-04-26T14:59:36Z")
Entities are fine in the HTML. But something’s going wrong because it’s double encoding the quote.
```
Musical inspirations behind Doom's music
```
From the JSON.
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [6 Maggio 2019, 1:21pm UTC](https://meta.discourse.org/t/onebox-encodes-single-quotes-in-url-breaking-the-link/115947/8 "2019-05-06T13:21:59Z")
> [@sam](#):
>
> We should follow the spec here with our encoding.
> [@sam](#):
>
> I guess we need one rule for encoding the query params and another for encoding the path.
Done in:
[https://github.com/discourse/onebox/commit/7a1885c48800693d9d4abfa9c58d6d25fd19ca65](https://github.com/discourse/onebox/commit/7a1885c48800693d9d4abfa9c58d6d25fd19ca65)
* * *
[https://doomwiki.org/wiki/Musical\_inspirations\_behind\_Doom’s\_music](https://doomwiki.org/wiki/Musical_inspirations_behind_Doom's_music)
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [6 Maggio 2019, 1:22pm UTC](https://meta.discourse.org/t/onebox-encodes-single-quotes-in-url-breaking-the-link/115947/9 "2019-05-06T13:22:13Z")