Fix double encoding in new url transform

ClosesGH-797.

Author: wooorm

lib/index.js

@@ -84,7 +84,6 @@
 import{unreachable}from'devlop'
 import{toJsxRuntime}from'hast-util-to-jsx-runtime'
 import{urlAttributes}from'html-url-attributes'
-import{sanitizeUri}from'micromark-util-sanitize-uri'
 // @ts-expect-error: untyped.
 import{Fragment,jsx,jsxs}from'react/jsx-runtime'
 importremarkParsefrom'remark-parse'
@@ -297,5 +296,26 @@ export function Markdown(options) {
  * Safe URL.
  */
 exportfunctiondefaultUrlTransform(value){
-returnsanitizeUri(value,safeProtocol)
+// Same as:
+// <https://github.com/micromark/micromark/blob/929275e/packages/micromark-util-sanitize-uri/dev/index.js#L34>
+// But without the `encode` part.
+constcolon=value.indexOf(':')
+constquestionMark=value.indexOf('?')
+constnumberSign=value.indexOf('#')
+constslash=value.indexOf('/')
+
+if(
+// If there is no protocol, it’s relative.
+colon<0||
+// If the first colon is after a `?`, `#`, or `/`, it’s not a protocol.
+(slash>-1&&colon>slash)||
+(questionMark>-1&&colon>questionMark)||
+(numberSign>-1&&colon>numberSign)||
+// It is a protocol, it should be allowed.
+safeProtocol.test(value.slice(0,colon))
+){
+returnvalue
+}
+
+return''
 }

package.json

@@ -81,7 +81,6 @@
 "hast-util-to-jsx-runtime": "^2.0.0",
 "html-url-attributes": "^3.0.0",
 "mdast-util-to-hast": "^13.0.0",
-"micromark-util-sanitize-uri": "^2.0.0",
 "remark-parse": "^11.0.0",
 "remark-rehype": "^11.0.0",
 "unified": "^11.0.0",

test.jsx

@@ -326,6 +326,13 @@ test('react-markdown', async function (t) {
 )
 })
 
+awaitt.test('should support hash (`&`) in a URL',function(){
+assert.equal(
+asHtml(<Markdownchildren="[](a?b&c=d)"/>),
+'<p><a href="a?b&amp;c=d"></a></p>'
+)
+})
+
 awaitt.test('should support hash (`#`) in a URL',function(){
 assert.equal(
 asHtml(<Markdownchildren="[](a#javascript:alert(1))"/>),