Fix to remove non-terminated character references

Related-to: remarkjs/remark#913.
This commit is contained in:
Titus Wormer 2022-10-24 11:19:10 +02:00
parent ff45db552e
commit 7301073466
No known key found for this signature in database
GPG key ID: E6E581152ED04E2E
2 changed files with 32 additions and 3 deletions

View file

@ -131,7 +131,12 @@ export function directiveHtml(options = {}) {
/** @type {Attribute[]} */ /** @type {Attribute[]} */
// @ts-expect-error // @ts-expect-error
const attributes = this.getData('directiveAttributes') const attributes = this.getData('directiveAttributes')
attributes.push(['id', parseEntities(this.sliceSerialize(token))]) attributes.push([
'id',
parseEntities(this.sliceSerialize(token), {
attribute: true
})
])
} }
/** @type {_Handle} */ /** @type {_Handle} */
@ -140,7 +145,12 @@ export function directiveHtml(options = {}) {
// @ts-expect-error // @ts-expect-error
const attributes = this.getData('directiveAttributes') const attributes = this.getData('directiveAttributes')
attributes.push(['class', parseEntities(this.sliceSerialize(token))]) attributes.push([
'class',
parseEntities(this.sliceSerialize(token), {
attribute: true
})
])
} }
/** @type {_Handle} */ /** @type {_Handle} */
@ -160,7 +170,8 @@ export function directiveHtml(options = {}) {
// @ts-expect-error // @ts-expect-error
const attributes = this.getData('directiveAttributes') const attributes = this.getData('directiveAttributes')
attributes[attributes.length - 1][1] = parseEntities( attributes[attributes.length - 1][1] = parseEntities(
this.sliceSerialize(token) this.sliceSerialize(token),
{attribute: true}
) )
} }

View file

@ -1347,6 +1347,24 @@ test('content', (t) => {
'should support unknown character references in attribute values' 'should support unknown character references in attribute values'
) )
t.equal(
micromark(':a{href=&param}', options({'*': h})),
'<p><a href="&amp;param"></a></p>',
'should not support non-terminated character references in unquoted attribute values'
)
t.equal(
micromark(':a{href="&param"}', options({'*': h})),
'<p><a href="&amp;param"></a></p>',
'should not support non-terminated character references in double quoted attribute values'
)
t.equal(
micromark(":a{href='&param'}", options({'*': h})),
'<p><a href="&amp;param"></a></p>',
'should not support non-terminated character references in single quoted attribute values'
)
t.equal( t.equal(
micromark(':span{a\nb}', options({'*': h})), micromark(':span{a\nb}', options({'*': h})),
'<p><span a="" b=""></span></p>', '<p><span a="" b=""></span></p>',