URLs to issues/pull-requests for repos or users with dash in the name are not linked correctly

[rtpt-alexanderneumann]

Gitea Version

1.16.2

Git Version

2.30.2

Operating System

Debian 11

How are you running Gitea?

I'm using the released version of Gitea downloaded from GitHub as a systemd service. The same issue reproduces on https://try.gitea.io

Database

SQLite

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

Description

Full URLs to issues and pull requests are not correctly linked and there is no hover preview when the owner's name or the repository name contains a dash. For example, create the repos firstrepo and second-repo on the demo instance, create an issue in each of them and then submit the following text as a new issue:

 * https://try.gitea.io/username/firstrepo/issues/1
 * https://try.gitea.io/username/second-repo/issues/1

It is rendered as:

 * username/firstrepo#1
 * https://try.gitea.io/username/second-repo/issues/1

Screenshots

[rtpt-alexanderneumann]

It looks like there's a mismatch between the set of characters of valid repo/usernames and the regexp used for matching full URLs. For the user/repo names the only reference I found is here, but it does not match upper case characters:

gitea/modules/references/references.go

Line 25 in e4ef61e

validNamePattern = regexp.MustCompile(`^[a-z0-9_.-]+$`)

The regex used to match full URLs, which uses \w+ here:

gitea/modules/markup/html.go

Lines 101 to 103 in e4ef61e

	issueFullPattern = regexp.MustCompile(regexp.QuoteMeta(setting.AppURL) +
	`\w+/\w+/(?:issues|pulls)/((?:\w{1,10}-)?[1-9][0-9]*)([\?|#](\S+)?)?\b`)
	})

I propose to extend the regex from \w+ to [\w_.-]+ and will open a PR shortly. If there is a better way (like a central regex that we could reference instead) please let me know!

[rtpt-alexanderneumann]

@KN4CK3R mentioned in #18890 that a dot in a character list (within []) still matches any character, so probably the regexp in references.go is wrong as well and should be corrected to ^[a-z0-9_\.-]+$. Is that correct? Shall I create another PR?

[KN4CK3R]

No, it's ok without escaping. I was wrong.

[rtpt-alexanderneumann]

Ok, thanks for the feedback. I used a wrong test case first and thought you were right...