Files
John MacFarlane 649aae2f4c SelfContained: fix regression in escaping of data URIs.
A change in 3.12 broke escaping of data URIs, so that
`--embed-resources` no longer worked properly with JavaScript
includes, breaking slide show formats.

Closes #11942.
2026-10-07 09:03:28 -07:00

573 B

Characters with special meaning in a URI must be percent-encoded in a textual data: URI. In particular a bare # would truncate the payload at the fragment delimiter, and bare & or ' would be HTML-escaped into entities by the serializer.

(The </script> in the resource is what forces the data: URI path rather than inlining the script contents.)

% pandoc --embed-resources
<script src="command/11942.js"></script>
^D
<script src="data:text/javascript;charset=utf-8,var%20sel%20%3D%20%27%23main%27%20%26%201%3B%20%2F%2F%20%3C%2Fscript%3E%0A"></script>