From 84b174f3fcc50646e201635de29589ce5b8d1aaa Mon Sep 17 00:00:00 2001
From: Anton Petnitsky <168552591+Mukller@users.noreply.github.com>
Date: Wed, 29 Jul 2026 16:27:58 +0300
Subject: [PATCH] fix(render_helpers): guard against .tld false positives in
 linkify (#817)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The linkify regex has a leading optional group that may match zero characters
(the `\.*` branch for relative references). When it matches zero characters,
the negative lookbehind `(?<![/=?#&\.])` checks the char immediately before
the first real character of the pattern — which is the `.` of a dotted suffix.

In an href attribute like `https://example.com`, the `.` before `com` is
preceded by `e` (a word character). `e` is not in `[/=?#&.]`, so the lookbehind
passes and `.com` is matched as a relative reference, corrupting the URL.

Adding `\w` to the lookbehind set prevents any dot that is immediately preceded
by a word character from being the start of a relative-reference match. Standalone
relative references like `.Foo` in prose are preceded by whitespace or punctuation
and are unaffected.
---
 pdoc/render_helpers.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pdoc/render_helpers.py b/pdoc/render_helpers.py
index f0c925e7..8c1ab9a3 100644
--- a/pdoc/render_helpers.py
+++ b/pdoc/render_helpers.py
@@ -405,7 +405,7 @@ def linkify_repl(m: re.Match):
         re.sub(
             r"""
             # Part 1: foo.bar or foo.bar() (without backticks)
-            (?<![/=?#&\.])  # heuristic: not part of a URL
+            (?<![/=?#&\.\w])  # heuristic: not part of a URL or word
             # First part of the identifier (e.g. "foo") - this is optional for relative references.
             (?:
                 \b