| Encode backslashes and ampersands in `to_markdown` links (#58903)
Some Markdown renderers turned a link emitted by `to_markdown` into a
`javascript:` link, even though its href passed `allowed_uri?`. Markdown
decodes backslash escapes and character references in a link
destination, so an href such as `javascript\:alert(1)` or
`javascript\:alert(1)` became a `javascript:` link after rendering.
Percent-encode backslashes and write ampersands as `&` in link
destinations. |