Failing to publish to npm when package's README has ")AND1<2" in it

[gravitypersists]

I had tried publishing a package, via cli, with the following string in its README:

(3 > 2) AND (3 < 10)

It failed, reporting a 403. Removing that string from the README solved the issue.

I diagnosed the issue a bit further and reduced it down to anything matching \)AND\d\<\dwill produce this error. So having the string )AND1<2 will also fail to publish.

(I wouldn't be surprised if my organization just has a funny regex security rule configured into npm, if that exists... but I thought I'd report it anyways because I imagine it's a pervasive little bug that will rarely be crossed)

[ljharb]

readmes are markdown, which accept HTML, so you have to escape < and > anyways. Have you tried that?

[ljharb]

No, not backticks, escaped. Like < and &rt;.

[arcanis]

readmes are markdown, which accept HTML, so you have to escape < and > anyways

It's not mandatory; Markdown autoescapes:

Markdown allows you to use these characters naturally, taking care of all the necessary escaping for you. If you use an ampersand as part of an HTML entity, it remains unchanged; otherwise it will be translated into &.

Similarly, because Markdown supports inline HTML, if you use angle brackets as delimiters for HTML tags, Markdown will treat them as such. But if you write 4 < 5, Markdown will translate it to4 < 5

As long as &, <, and > are surrounded by spaces, it shouldn't be a problem.

[ljharb]

ah, thanks for clarifying.

[gravitypersists]

I would assume any markdown engine does not try to parse characters within backticks as tags...

But fwiw, no ) AND (3 < 10) does not experience this error. But it does look like this when you look at it:

[ljharb]

Sounds like it's indeed a bug, then :-)