Is any escaping of URIs within "3.11.6 Messages with embedded links" needed?

[davidmalcolm]

"3.11.6 Messages with embedded links" has:

link destination = ? Any valid URI ?;
embedded link = "[", link text, "](", link destination, ")";

My reading of the spec if that no escaping is needed/done on the link destination, and thus it is implicitly required that URIs do not contain ) so that a consumer can detect where the link destination ends.

Am I correct? Is this lack of ) guaranteed by RFC 3896, an additional constraint in SARIF, or is some kind of matching of ( and ) pairs assumed for SARIF consumers? (and is that guaranteed by RFC 3896?)

[sthagen]

Interesting question, thank you. I added the question and to be discussed labels, as I think the TC should consider this question.

[davidmalcolm]

"On RFC 3896: I don’t believe lack of ) is guaranteed. e.g., https://en.wikipedia.org/wiki/Parenthesis_(disambiguation)"