Clarify that comment links work on html-escaped text. Additionally improve the default `https` linkifying to not match escaped characters. Google-Bug-Id: b/295554653 Bug: Issue 352081004 Release-Notes: Improve `https` linking to not match escaped characters. Change-Id: Ib4820432f018c682bc41e479b2877009348b2826 (cherry picked from commit 77419832e320abd91d79a62116f840fd3d402c96)

diff --git a/Documentation/config-gerrit.txt b/Documentation/config-gerrit.txt
index 6a25259..5fc90f7 100644
--- a/Documentation/config-gerrit.txt
+++ b/Documentation/config-gerrit.txt

@@ -1760,6 +1760,10 @@
 configuration 'tracker' uses raw HTML to more precisely control
 how the replacement is displayed to the user.
 
+Before matching is done the relevant contents are html-escaped. If 'match' needs
+to contain `&`, `<`, `>`, `"` or  `'`, replace them with `&amp;`, `&gt;`,
+`&lt;`, `&quot;` and `&apos;` respectively.
+
 commentlinks supports link:#reloadConfig[configuration reloads]. Though a
 link:cmd-flush-caches.html[flush-caches] of "projects" is needed for the
 commentlinks to be immediately available in the UI.

diff --git a/polygerrit-ui/app/utils/link-util.ts b/polygerrit-ui/app/utils/link-util.ts
index afc6745..2737a67 100644
--- a/polygerrit-ui/app/utils/link-util.ts
+++ b/polygerrit-ui/app/utils/link-util.ts

@@ -36,7 +36,7 @@
   );
   // Always linkify URLs starting with https?://
   enabledRewrites.push({
-    match: '(https?://\\S+[\\w/])',
+    match: '(https?://((?!&(gt|lt|amp|quot|apos);)\\S)+[\\w/~-])',
     link: '$1',
   });
   return enabledRewrites.flatMap(rewrite => {