Hash/Pound-sign/# not escaped in `:title` Permalink, breaking URLs

I haven’t seen this after Googling around and searching this forum. The closest thing I’ve found is https://github.com/gohugoio/hugo/issues/3577 which references slashes.

So, I thought maybe I’ve just been overlooking something “obvious”?

My config sets posts = ":title" for permalinks.

My post title is as such:

title: "tcg's cool posts #2"

On the list page, the code to display the post and link is:

<span class="post-title"><a href="{{ .Permalink }}">{{ .Title }}</a></span>

The resulting HTML during local dev:

<a href="http://localhost:1313/tcgs-cool-posts-#2/">tcg's cool posts #2</a>

You can probably see that the URL is going to be a 404, because of the unescaped hash mark.

Is this expected?

I would think not, and it doesn’t seem like .Permalink should require its own escaping. I also don’t feel right pre-escaping my post meta values.

Should I file a bug, or am I Doing It Wrong?

EDIT: Was using v0.42.2; seeing the same on v0.43

I think the way folks get around those things is by setting :slug in permalinks. That way, it is based on your title unless you set the slug, which you do for the outliers.

Yeah, that just doesn’t make sense to me as a default behavior, especially if it doesn’t try to URL escape those values when generating names. Something seems weird about that.

Filed a bug, because it seems strange that a human would always have to be sure they were somehow providing a URL-friendly value: https://github.com/gohugoio/hugo/issues/4926