Is any escaping of URIs within "3.11.6 Messages with embedded links" needed?

[davidmalcolm]

"3.11.6 Messages with embedded links" has:

link destination = ? Any valid URI ?;
embedded link = "[", link text, "](", link destination, ")";

My reading of the spec if that no escaping is needed/done on the link destination, and thus it is implicitly required that URIs do not contain ) so that a consumer can detect where the link destination ends.

Am I correct? Is this lack of ) guaranteed by RFC 3896, an additional constraint in SARIF, or is some kind of matching of ( and ) pairs assumed for SARIF consumers? (and is that guaranteed by RFC 3896?)

[sthagen]

Interesting question, thank you. I added the question and to be discussed labels, as I think the TC should consider this question.

[davidmalcolm]

"On RFC 3896: I don’t believe lack of ) is guaranteed. e.g., https://en.wikipedia.org/wiki/Parenthesis_(disambiguation)"

[sthagen]

Clarification (attempt): Talking URIs we will want to compare notes with RFC 3986 "Uniform Resource Identifier (URI): Generic Syntax" and not with the (twisted digits?) RFC 3896 "Definitions of Managed Objects for the DS3/E3 Interface Type".

[sthagen]

Answer (attempt): @davidmalcolm

My reading of the spec if that no escaping is needed/done on the link destination,

yes, as the path part of a URI can (and will cf. e.g. wikipedia links ...) contain unescaped parentheses.
These can even be unbalanced (imagine some link shortening service utilizing such characters in the base set without the semantics of "embracing" something else).

Solving some [unbalanced](https://example.org/aFgH)x_) class of problems is the doable task for the markdown parser consuming the text. Markdown is intentionally able to convey enough layout by spacing and minimal extra tokens to be rendered in our brains when scanned through our eyes.
Also, there are many ways that markdown parsers add magic in amending what could be URIs (per guessing, accepting HTML syntax, also I think angle brackets, ...)

and thus it is implicitly required that URIs do not contain ) so that a consumer can detect where the link destination ends.

no, as the semantiocs of unescaped parentheses and other "interesting" characters in the path portion of a URI are left as an exercise to the reader (consumer).

Does that make sense?