@oneuptime/common 14.0.9 → 14.0.11

package/build/dist/Utils/Markdown/UntrustedMarkdown.js

@@ -0,0 +1,988 @@
+import { escapeMarkdownInline } from "./MarkdownEscape";
+import { Lexer } from "marked";
+/*
+ * MARKDOWN WRITTEN BY SOMEBODY OUTSIDE - an incident form's reporter, who
+ * needs no account, only the form's link - made safe to store as an
+ * incident's own text.
+ *
+ * Nobody reads such text over before it is posted: the incident's title and
+ * description go straight into its "Incident Created" feed item, which is
+ * posted to the project's Slack and Microsoft Teams channels, and the
+ * description and Markdown custom field answers are rendered for every
+ * responder who opens the incident (the dashboard renders incident text
+ * without the viewer's safe mode) and in the owners' and on-call emails.
+ * Three things in it act on their own there, before anybody decides to
+ * click anything:
+ *
+ *   - CHAT CONTROL SEQUENCES. Slack reads <!channel>, <!here>, <!everyone>,
+ *     <!subteam^ID>, <@U123> and <#C123> in a bot's message as mentions, so
+ *     a stranger could make OneUptime's bot notify a whole channel.
+ *     neutralizeChatControlSequences puts an invisible word joiner (U+2060)
+ *     between the "<" and the "!", "@" or "#": the text reads as typed, but
+ *     is no longer a sequence Slack (or slackify, which then escapes the
+ *     lone "<") recognises. It is applied everywhere in the text, code
+ *     included: slackify passes code through untouched, so a mention inside
+ *     a code span would reach Slack as it is. Only what Slack acts on is
+ *     broken - "<!" and a word, "<@" or "<#" and an id - so an HTML comment
+ *     (<!--), CDATA, a <!DOCTYPE html> or a PowerShell "<# ... #>" pasted
+ *     into a report is stored exactly as typed.
+ *
+ *   - IMAGES. ![alt](https://tracker.example/p.png) is fetched from the
+ *     outsider's server by every responder's browser and mail client that
+ *     shows the incident: a zero-click beacon of who looked, when, and from
+ *     where. Each image becomes a plain link to the same address, so nothing
+ *     is fetched until somebody chooses to follow it: the "!" is escaped,
+ *     which is the one change that turns an image into a link without
+ *     rewriting anything else, and an image with no alt text is given its
+ *     address as the link's text, so the link is not an empty, invisible
+ *     one. Reference-style images (![alt][ref], ![ref]) are covered: they
+ *     start with the same "![".
+ *
+ *   - MERMAID DIAGRAMS. A ```mermaid fence is rendered as a diagram, which
+ *     runs mermaid's renderer (and can load images) in the responder's
+ *     browser. Its language becomes "text", so it shows as the code the
+ *     reporter typed.
+ *
+ * WHAT MAKES IT SAFE DOES NOT DEPEND ON HOW ANY ONE RENDERER READS THE TEXT.
+ * The same text is read by marked (the emails), by remark with its GitHub
+ * extensions, footnotes included (the dashboard), and by slackify, and they
+ * do not agree on everything. "[a]: https://a.example" followed by an
+ * indented "![x](...)" line, or a footnote's indented paragraph, is an
+ * indented code block to marked and a paragraph - with a live image - to
+ * the dashboard; a footnote definition is no more than a link definition to
+ * marked. So the guarantee is made on the characters, where every renderer
+ * agrees:
+ *
+ *   - Nothing is an image unless it starts with "![" (an entity is only
+ *     text, and raw HTML is shown as text in the dashboard and escaped in
+ *     the emails). Every "![" whose "!" is not already escaped, and which
+ *     something after it could complete - a "](" or "][" before its
+ *     paragraph can end at a blank line, or, anywhere in the text, a line
+ *     that could define a link reference ("[label]:" after nothing but
+ *     indentation, block quote and list markers, a task list item's box or
+ *     a footnote's label) - is broken:
+ *     a backslash goes before the "!", or an invisible word joiner between
+ *     the "!" and the "[". Either way no renderer finds an image there.
+ *     The one exception is fenced code that every renderer reads as such
+ *     (see findTrustedCode): no renderer finds an image in it, so it is
+ *     left byte for byte.
+ *   - The dashboard draws a diagram only for a fenced code block whose
+ *     language is "mermaid" - and CommonMark decodes character references
+ *     in a fence's info string, so ```&#109;ermaid is one too. After the
+ *     first fence run of every line, every "mermaid" in the info string as
+ *     the dashboard decodes it is broken: a real fence's language is
+ *     renamed "text", and any other "mermaid" gets a word joiner before it,
+ *     so no language reads "mermaid" and no class reads "language-mermaid".
+ *
+ * A real Markdown lexer (marked) only decides which of those the text gets,
+ * so that it still reads as typed: an image it finds gets the backslash (and
+ * its address as link text when it had no alt text); a "![" inside what it
+ * reads as a code span, a code block or raw HTML - where a backslash would
+ * show - gets the invisible joiner; any other "![" gets the backslash, which
+ * every renderer turns back into the "!" as typed, in a link's address too.
+ * A mermaid fence it finds is renamed; any other "mermaid" after a fence run
+ * gets the joiner. The joiner cannot be seen, but it is a character: a copy
+ * of the text keeps it. Code with no image syntax that could be completed -
+ * "Wow![sic]", Rust's vec![1, 2] in a paragraph of its own, anything inside
+ * a fenced block every renderer reads as code - is left byte for byte.
+ *
+ * The lexer does not say where in the text a token came from, so every place
+ * to change is first tagged with a numbered marker the lexer passes through
+ * untouched (private use characters, inert to Markdown); a marker that ends
+ * up right before an image token, inside a code span, a code block or HTML,
+ * or at the start of a code block's language, says what that place is.
+ *
+ * THE LEXER ONLY READS SHORT TEXT. marked takes time that grows with the
+ * square of the text on some shapes - emphasis next to image syntax, a long
+ * run of unclosed emphasis - and a description may be 20000 characters of
+ * them: seconds of one process's CPU, from anyone holding a form's link.
+ * Everything else here is linear, and the lexer is used only for a text of
+ * at most LEXED_TEXT_MAX_LENGTH characters. A longer one, or one the lexer
+ * fails on, is decided without it (findWithoutLexing): a "![" on an
+ * indented line or inside a code span of its own line gets the joiner, any
+ * other the backslash - and an image with no alt text still gets its
+ * address as link text when its address can be read on its line - while
+ * only a fence every renderer reads as one is renamed "text"; every other
+ * "mermaid" gets the joiner. Just as safe, and a little less tidy where a
+ * backslash lands in code.
+ *
+ * Links are left alone: a reporter linking the page that is broken is the
+ * point of a report, and a link does nothing until somebody clicks it.
+ *
+ * Pure, with no database or React imports.
+ */
+const WORD_JOINER = "\u2060";
+/*
+ * Where a chat control sequence starts, as Slack reads one: "<!" and a word
+ * (<!here>, <!channel>, <!everyone>, <!subteam^ID>, <!date^...>), "<@" and
+ * a user id, "<#" and a channel id. Not an HTML comment (<!--), CDATA
+ * (<![CDATA[), or a document type or other SGML declaration (<!DOCTYPE
+ * html>, <!ENTITY ...>): none of them is a Slack sequence, and a reporter
+ * pastes them in HTML. Nor a PowerShell block comment, "<#" and a space.
+ */
+const CHAT_CONTROL_SEQUENCE_START_PATTERN = /<(?=[@#][a-z0-9]|!(?![-[]|(?:doctype|entity|element|attlist|notation)(?![a-z0-9])))/gi;
+/**
+ * The text as typed, with every "<!", "<@" and "<#" that Slack could read
+ * as a mention broken by an invisible word joiner, so no chat tool reads a
+ * mention in it. Idempotent: a joiner already there is not doubled.
+ */
+export const neutralizeChatControlSequences = (value) => {
+    if (value === undefined || value === null) {
+        return "";
+    }
+    return String(value).replace(CHAT_CONTROL_SEQUENCE_START_PATTERN, `<${WORD_JOINER}`);
+};
+/*
+ * Private use characters, which nobody types and Markdown treats as plain
+ * text: MARKER_START, a number and MARKER_END tag one place in the probe.
+ * A marker only steers which change a place gets, never whether it gets
+ * one, so a reporter who does type these characters decides nothing.
+ */
+const MARKER_START = "\uE000";
+const MARKER_END = "\uE001";
+const MARKER_PATTERN = /\uE000(\d+)\uE001/g;
+const MARKER_AT_END_PATTERN = /\uE000(\d+)\uE001$/;
+const MARKER_AT_START_PATTERN = /^\uE000(\d+)\uE001/;
+/*
+ * The longest text the lexer is given (see "THE LEXER ONLY READS SHORT
+ * TEXT" above). The worst shapes found take about 20 milliseconds at this
+ * length, four times that at twice it, and seconds at the 20000 characters
+ * a description may have.
+ */
+export const LEXED_TEXT_MAX_LENGTH = 1000;
+/*
+ * A fence run: three or more backticks or tildes. The first one in a line
+ * is where a fenced code block's info string could begin, whatever comes
+ * before it - a block quote or a list item's marker, indentation, or text
+ * no renderer reads as a fence at all (which is only broken for nothing).
+ */
+const FENCE_RUN_PATTERN = /`{3,}|~{3,}/;
+// A fence run at the very start of a line, and the info string after it.
+const OPENING_FENCE_PATTERN = /^(?:(`{3,})[^`]*|(~{3,}).*)$/;
+// The spaces or tabs between a fence run and its info string.
+const FENCE_INFO_INDENT_PATTERN = /^[ \t]*/;
+/*
+ * Raw HTML that starts a block which blank lines do not end (CommonMark's
+ * HTML blocks 1 to 5: <script>, <pre>, <style> and <textarea>, comments,
+ * processing instructions, declarations and CDATA) - anywhere in a line, to
+ * be sure of catching every one.
+ */
+const RAW_HTML_BLOCK_START_PATTERN = /<(?:[!?]|script|pre|style|textarea)/i;
+const BLANK_LINE_TEXT_PATTERN = /^[ \t]*$/;
+// What marked allows after a closing fence's run: backticks, tildes, spaces.
+const MARKED_CLOSING_FENCE_REST_PATTERN = /^[~`]* *$/;
+const MERMAID = "mermaid";
+const DEMOTED_LANGUAGE = "text";
+/*
+ * A numeric character reference - decimal or hexadecimal - as CommonMark
+ * decodes one in a fence's info string: ```&#109;ermaid is a mermaid fence
+ * to the dashboard. More digits are allowed than CommonMark allows, so a
+ * reference no renderer decodes can only be broken for nothing. Nothing
+ * else needs decoding to find every "mermaid": a named reference never
+ * stands for a letter of the English alphabet, and a backslash escape only
+ * ever stands for punctuation (reading "\&#109;" as a reference anyway only
+ * breaks what was never a diagram).
+ */
+const NUMERIC_CHARACTER_REFERENCE_PATTERN = /^&#(?:[xX]([0-9a-fA-F]{1,32})|([0-9]{1,32}));/;
+const NUMERIC_CHARACTER_REFERENCE_MAX_LENGTH = 36;
+const REPLACEMENT_CHARACTER = "\uFFFD";
+/*
+ * What can complete an image after its "![": a closing bracket followed by
+ * an address, "](", or by a reference label, "][" - with spaces or tabs
+ * allowed between, although no renderer here allows them. None can reach
+ * past a blank line, where every paragraph ends; and a link reference
+ * definition anywhere in the text could complete any "![label]".
+ */
+const IMAGE_COMPLETION_PATTERN = /\][ \t]*[([]/g;
+const BLANK_LINE_PATTERN = /\n[ \t]*(?=\n|$)/g;
+/*
+ * What may come before a link reference definition's "[" on its line:
+ * indentation; the markers of block quotes and list items; a task list
+ * item's box, which marked takes off "- [ ] [a]: https://..." before it
+ * reads the rest as the item's own blocks; footnote definitions (a
+ * footnote's content, "[^1]: [a]: https://...", may itself start with
+ * one); and a byte order mark, which the dashboard's parser skips at the
+ * start of the text. A "]:" anywhere else - a Python slice, a TypeScript
+ * index signature after code, "sshd[1]:" in a log - defines nothing.
+ */
+const REFERENCE_DEFINITION_PREFIX_PATTERN = /^(?:[ \t>*+\-.)0-9\uFEFF]|\[[^\]\n]\][ \t]*|\[\^[^\]\n]*\]:)*/;
+// An image link's text, when the image had no alt text: its address.
+const IMAGE_LINK_LABEL_MAX_LENGTH = 80;
+const IMAGE_LINK_FALLBACK_LABEL = "image";
+/*
+ * How far past "![](" the address of an image with no alt text is looked
+ * for when the lexer does not read the text: an address this long is
+ * rare, and the link then simply keeps the text it had.
+ */
+const IMAGE_ADDRESS_SCAN_MAX_LENGTH = 2048;
+// A backslash before ASCII punctuation, which marked drops from an address.
+const ESCAPED_PUNCTUATION_PATTERN = /\\([!-/:-@[-`{-~])/g;
+// A line that could be an indented code block's.
+const INDENTED_LINE_PATTERN = /^(?: {4}|\t)/;
+const BACKTICK_RUN_PATTERN = /`+/g;
+const IMAGE_OPENER_PATTERN = /!(?=\[)/g;
+// A "]" that a link, a reference or a link definition goes on from.
+const LINK_TAIL_OPENER_PATTERN = /\](?=[([:])/g;
+var CandidateKind;
+(function (CandidateKind) {
+    CandidateKind["Image"] = "image";
+    CandidateKind["Mermaid"] = "mermaid";
+})(CandidateKind || (CandidateKind = {}));
+const splitLines = (source) => {
+    const lines = [];
+    let start = 0;
+    for (;;) {
+        const newline = source.indexOf("\n", start);
+        if (newline === -1) {
+            lines.push({ start: start, end: source.length });
+            return lines;
+        }
+        lines.push({ start: start, end: newline });
+        start = newline + 1;
+    }
+};
+// Whether an odd number of backslashes comes right before this character.
+const isEscaped = (source, position) => {
+    let backslashes = 0;
+    while (position - backslashes - 1 >= 0 &&
+        source[position - backslashes - 1] === "\\") {
+        backslashes++;
+    }
+    return backslashes % 2 !== 0;
+};
+const isInTrustedCode = (code, position) => {
+    let low = 0;
+    let high = code.ranges.length - 1;
+    while (low <= high) {
+        const middle = (low + high) >> 1;
+        const range = code.ranges[middle];
+        if (position < range[0]) {
+            high = middle - 1;
+        }
+        else if (position >= range[1]) {
+            low = middle + 1;
+        }
+        else {
+            return true;
+        }
+    }
+    return false;
+};
+/*
+ * Whether a line closes a fence opened with this run, as CommonMark reads it
+ * (up to three spaces, at least as long a run of the same character, then
+ * only spaces or tabs) and as marked does (up to three spaces, the same run,
+ * then any backticks or tildes and spaces).
+ */
+const readClosingFence = (line, run) => {
+    let indent = 0;
+    while (indent < line.length && line[indent] === " ") {
+        indent++;
+    }
+    if (indent > 3) {
+        return { byCommonMark: false, byMarked: false };
+    }
+    let end = indent;
+    while (end < line.length && line[end] === run[0]) {
+        end++;
+    }
+    return {
+        byCommonMark: end - indent >= run.length &&
+            BLANK_LINE_TEXT_PATTERN.test(line.slice(end)),
+        byMarked: line.startsWith(run, indent) &&
+            MARKED_CLOSING_FENCE_REST_PATTERN.test(line.slice(indent + run.length)),
+    };
+};
+/*
+ * The fenced code blocks that every renderer here reads as fenced code, and
+ * so as nothing but code: no image and no diagram can be in them.
+ *
+ * Trusted only as far as this can be sure of: a fence opened at the very
+ * start of a line (no indentation, no container) that follows a blank line,
+ * the start of the text or the close of another such fence. Nothing else
+ * can hold that line - a block quote, a list item or a footnote needs its
+ * marker or its indentation on it, and an HTML block of the kinds a blank
+ * line ends is over - except a fence or an HTML block that blank lines do
+ * not end. So trust stops for good at the first line outside such a fence
+ * that holds a fence run anywhere, or the start of such an HTML block
+ * anywhere, and at the first line that closes a fence for one renderer but
+ * not the other (marked closes "```" with "```~", CommonMark with
+ * "```\t"): after it, the renderers could pair the fences that follow
+ * differently.
+ */
+const findTrustedCode = (source, lines) => {
+    const code = {
+        ranges: [],
+        openingInfoStarts: new Set(),
+    };
+    let isTrusting = true;
+    // The line before was blank, closed a trusted fence, or there was none.
+    let mayOpen = true;
+    // The run the trusted fence the scan is in was opened with.
+    let openRun = null;
+    for (const line of lines) {
+        const text = source.slice(line.start, line.end);
+        if (openRun !== null) {
+            const closing = readClosingFence(text, openRun);
+            if (closing.byCommonMark || closing.byMarked) {
+                openRun = null;
+                mayOpen = true;
+                isTrusting = closing.byCommonMark && closing.byMarked;
+                continue;
+            }
+            const previous = code.ranges[code.ranges.length - 1];
+            if (previous && previous[1] + 1 === line.start) {
+                previous[1] = line.end;
+            }
+            else {
+                code.ranges.push([line.start, line.end]);
+            }
+            continue;
+        }
+        const opening = isTrusting && mayOpen ? OPENING_FENCE_PATTERN.exec(text) : null;
+        if (opening) {
+            openRun = (opening[1] || opening[2]);
+            code.openingInfoStarts.add(line.start +
+                openRun.length +
+                FENCE_INFO_INDENT_PATTERN.exec(text.slice(openRun.length))[0].length);
+            continue;
+        }
+        if (FENCE_RUN_PATTERN.test(text) ||
+            RAW_HTML_BLOCK_START_PATTERN.test(text)) {
+            isTrusting = false;
+        }
+        mayOpen = BLANK_LINE_TEXT_PATTERN.test(text);
+    }
+    return code;
+};
+/*
+ * Whether any renderer could read a link reference definition in the text,
+ * which would complete any "![label]" in it however far away: a "[label]:"
+ * outside trusted code whose "[" has nothing but REFERENCE_DEFINITION_PREFIX
+ * before it on its line. Generous on purpose - it does not check what
+ * follows the colon, or that the line may start a block at all.
+ */
+const hasPossibleReferenceDefinition = (data) => {
+    const source = data.source;
+    /*
+     * The line the last "[" was on, and where what may come before a
+     * definition ends on it. Each "[" is after the one before (see below),
+     * so both only move forward.
+     */
+    let lineIndex = 0;
+    let prefixEndLine = -1;
+    let prefixEnd = 0;
+    for (let colon = source.indexOf("]:"); colon !== -1; colon = source.indexOf("]:", colon + 1)) {
+        if (isEscaped(source, colon)) {
+            continue;
+        }
+        /*
+         * The label's "[": the nearest bracket before, as a label cannot hold
+         * one that is not escaped. Each search stops at the "]" of the one
+         * before it at the latest, so together they read the text once.
+         */
+        let open = colon - 1;
+        while (open >= 0 &&
+            !((source[open] === "[" || source[open] === "]") &&
+                !isEscaped(source, open))) {
+            open--;
+        }
+        if (open < 0 ||
+            source[open] !== "[" ||
+            isInTrustedCode(data.code, open)) {
+            continue;
+        }
+        while (data.lines[lineIndex].end < open) {
+            lineIndex++;
+        }
+        if (prefixEndLine !== lineIndex) {
+            const line = data.lines[lineIndex];
+            prefixEnd =
+                line.start +
+                    REFERENCE_DEFINITION_PREFIX_PATTERN.exec(source.slice(line.start, line.end))[0].length;
+            prefixEndLine = lineIndex;
+        }
+        if (open <= prefixEnd) {
+            return true;
+        }
+    }
+    return false;
+};
+/*
+ * Where each "mermaid" in source[start, end) starts, read as the dashboard
+ * reads an info string - with numeric character references decoded, and
+ * any letter case. One right after a word joiner is already broken.
+ */
+const findMermaidWords = (source, start, end) => {
+    // The decoded characters, and where in the source each one starts.
+    const characters = [];
+    const starts = [];
+    let position = start;
+    while (position < end) {
+        const reference = source[position] === "&"
+            ? NUMERIC_CHARACTER_REFERENCE_PATTERN.exec(source.slice(position, Math.min(end, position + NUMERIC_CHARACTER_REFERENCE_MAX_LENGTH)))
+            : null;
+        if (reference) {
+            const codePoint = reference[1]
+                ? parseInt(reference[1], 16)
+                : parseInt(reference[2], 10);
+            characters.push(codePoint > 0 &&
+                codePoint <= 0x10ffff &&
+                !(codePoint >= 0xd800 && codePoint <= 0xdfff)
+                ? String.fromCodePoint(codePoint)
+                : REPLACEMENT_CHARACTER);
+            starts.push(position);
+            position += reference[0].length;
+            continue;
+        }
+        characters.push(source[position]);
+        starts.push(position);
+        position++;
+    }
+    const words = [];
+    for (let index = 0; index + MERMAID.length <= characters.length;) {
+        let length = 0;
+        while (length < MERMAID.length &&
+            characters[index + length].toLowerCase() === MERMAID[length]) {
+            length++;
+        }
+        if (length < MERMAID.length) {
+            index++;
+            continue;
+        }
+        if (index === 0 || characters[index - 1] !== WORD_JOINER) {
+            words.push(starts[index]);
+        }
+        index += MERMAID.length;
+    }
+    return words;
+};
+/*
+ * Every info string with "mermaid" in it, as the dashboard decodes it: the
+ * rest of each line after its first fence run - wherever the run is, as no
+ * container before it is trusted to keep it from being a fence.
+ */
+const findDiagramInfoStrings = (source, lines) => {
+    const infoStrings = [];
+    for (const line of lines) {
+        const text = source.slice(line.start, line.end);
+        const run = FENCE_RUN_PATTERN.exec(text);
+        if (!run) {
+            continue;
+        }
+        const afterRun = run.index + run[0].length;
+        const start = line.start +
+            afterRun +
+            FENCE_INFO_INDENT_PATTERN.exec(text.slice(afterRun))[0].length;
+        const mermaidWords = findMermaidWords(source, start, line.end);
+        if (mermaidWords.length === 0) {
+            continue;
+        }
+        let languageEnd = start;
+        while (languageEnd < line.end &&
+            source[languageEnd] !== " " &&
+            source[languageEnd] !== "\t") {
+            languageEnd++;
+        }
+        infoStrings.push({
+            start: start,
+            languageEnd: languageEnd,
+            mermaidWords: mermaidWords,
+        });
+    }
+    return infoStrings;
+};
+/*
+ * The options marked's own parse uses by default (GitHub flavoured, no
+ * line-break extension), given afresh each time: the lexer writes into the
+ * options object it is handed, and must not see what another caller set up
+ * with marked.use().
+ */
+const lex = (markdown) => {
+    return new Lexer({ gfm: true, breaks: false, pedantic: false }).lex(markdown);
+};
+const getChildTokens = (token) => {
+    if (token.type === "list") {
+        return token.items;
+    }
+    if (token.type === "table") {
+        const table = token;
+        const cells = [...table.header];
+        for (const row of table.rows) {
+            cells.push(...row);
+        }
+        return cells.flatMap((cell) => {
+            return cell.tokens || [];
+        });
+    }
+    const nested = token.tokens;
+    return Array.isArray(nested) ? nested : [];
+};
+// Every token, depth first, in the order its text appears.
+const walkTokens = (tokens, visit) => {
+    for (const token of tokens) {
+        const children = getChildTokens(token);
+        visit(token, children.length === 0);
+        walkTokens(children, visit);
+    }
+};
+// Where each match of a global pattern starts, in order.
+const getMatchPositions = (source, pattern) => {
+    const positions = [];
+    for (const match of source.matchAll(pattern)) {
+        positions.push(match.index || 0);
+    }
+    return positions;
+};
+/*
+ * Every place to change, in order: each "![" that could open an image - its
+ * "!" not escaped (an even number of backslashes before it), not in trusted
+ * code, and something after it that could complete one (see
+ * IMAGE_COMPLETION_PATTERN) - and each info string with "mermaid" in it.
+ */
+const findCandidates = (data) => {
+    const source = data.source;
+    const candidates = [];
+    const mayHaveDefinition = hasPossibleReferenceDefinition(data);
+    const completions = getMatchPositions(source, IMAGE_COMPLETION_PATTERN);
+    const paragraphEnds = [
+        ...getMatchPositions(source, BLANK_LINE_PATTERN),
+        source.length,
+    ];
+    // Both only move forward, as the openers do.
+    let nextCompletion = 0;
+    let nextParagraphEnd = 0;
+    for (let position = source.indexOf("!["); position !== -1; position = source.indexOf("![", position + 1)) {
+        if (isEscaped(source, position) || isInTrustedCode(data.code, position)) {
+            continue;
+        }
+        while (nextCompletion < completions.length &&
+            completions[nextCompletion] <= position) {
+            nextCompletion++;
+        }
+        while (paragraphEnds[nextParagraphEnd] <= position) {
+            nextParagraphEnd++;
+        }
+        const isCompletable = mayHaveDefinition ||
+            (nextCompletion < completions.length &&
+                completions[nextCompletion] < paragraphEnds[nextParagraphEnd]);
+        if (isCompletable) {
+            candidates.push({ kind: CandidateKind.Image, position: position });
+        }
+    }
+    for (const info of findDiagramInfoStrings(source, data.lines)) {
+        candidates.push({
+            kind: CandidateKind.Mermaid,
+            position: info.start,
+            info: info,
+        });
+    }
+    /*
+     * A diagram candidate before an image one at the same place, so the
+     * lexer reads its marker first at the start of a code block's language.
+     */
+    return candidates.sort((a, b) => {
+        return (a.position - b.position ||
+            Number(a.kind === CandidateKind.Image) -
+                Number(b.kind === CandidateKind.Image));
+    });
+};
+/*
+ * What the lexer makes of each candidate place: the text is lexed with
+ * every one of them tagged by its number.
+ */
+const findInProbe = (source, candidates) => {
+    const parts = [];
+    let cursor = 0;
+    candidates.forEach((candidate, index) => {
+        parts.push(source.slice(cursor, candidate.position), `${MARKER_START}${index}${MARKER_END}`);
+        cursor = candidate.position;
+    });
+    parts.push(source.slice(cursor));
+    const found = {
+        images: new Map(),
+        literal: new Set(),
+        diagrams: new Set(),
+    };
+    const markLiteral = (text) => {
+        for (const marker of (text || "").matchAll(MARKER_PATTERN)) {
+            found.literal.add(Number(marker[1]));
+        }
+    };
+    let previousLeafRaw = "";
+    walkTokens(lex(parts.join("")), (token, isLeaf) => {
+        if (token.type === "image") {
+            /*
+             * The marker sits right before the "!", so it ends the text the
+             * lexer read just before this image.
+             */
+            const marker = MARKER_AT_END_PATTERN.exec(previousLeafRaw);
+            if (marker) {
+                found.images.set(Number(marker[1]), token.href);
+            }
+        }
+        if (token.type === "code") {
+            const code = token;
+            const marker = MARKER_AT_START_PATTERN.exec((code.lang || "").trim());
+            if (marker) {
+                found.diagrams.add(Number(marker[1]));
+            }
+            // The block's content, not its info string.
+            markLiteral(code.text);
+        }
+        if (token.type === "codespan" || token.type === "html") {
+            markLiteral(token.raw);
+        }
+        if (isLeaf) {
+            previousLeafRaw = token.raw || "";
+        }
+    });
+    return found;
+};
+/*
+ * The code spans of one line, as [start, end) offsets: a backtick run
+ * opens one that the next run of the same length on the line closes, as
+ * CommonMark pairs them. (A span that goes on to another line is not seen.)
+ */
+const getLineCodeSpans = (source, line) => {
+    var _a;
+    const runs = Array.from(source.slice(line.start, line.end).matchAll(BACKTICK_RUN_PATTERN));
+    // For each run, the next run of the same length, found from the end.
+    const nextOfSameLength = [];
+    const lastByLength = new Map();
+    for (let index = runs.length - 1; index >= 0; index--) {
+        const length = runs[index][0].length;
+        nextOfSameLength[index] = (_a = lastByLength.get(length)) !== null && _a !== void 0 ? _a : -1;
+        lastByLength.set(length, index);
+    }
+    const spans = [];
+    for (let index = 0; index < runs.length;) {
+        const closer = nextOfSameLength[index];
+        if (closer === -1) {
+            index++;
+            continue;
+        }
+        spans.push([
+            line.start + (runs[index].index || 0),
+            line.start + (runs[closer].index || 0) + runs[closer][0].length,
+        ]);
+        index = closer + 1;
+    }
+    return spans;
+};
+/*
+ * The address of an image whose "![](" ends at start, read no further than
+ * limit: "<...>" or a run without spaces (its parentheses balanced), then
+ * an optional title, then ")". Null when that cannot be read before limit -
+ * the image then simply gets no link text of its own.
+ */
+const readImageAddress = (source, start, limit) => {
+    let position = start;
+    const skipSpaces = () => {
+        while (position < limit &&
+            (source[position] === " " || source[position] === "\t")) {
+            position++;
+        }
+    };
+    // Where the character next occurs before limit, or -1.
+    const findBeforeLimit = (character, from) => {
+        for (let index = from; index < limit; index++) {
+            if (source[index] === character) {
+                return index;
+            }
+        }
+        return -1;
+    };
+    skipSpaces();
+    let address;
+    if (source[position] === "<") {
+        const close = findBeforeLimit(">", position + 1);
+        if (close === -1 || source.slice(position + 1, close).includes("<")) {
+            return null;
+        }
+        address = source.slice(position + 1, close);
+        position = close + 1;
+    }
+    else {
+        const addressStart = position;
+        let depth = 0;
+        while (position < limit) {
+            const character = source[position];
+            if (character === " " || character === "\t") {
+                break;
+            }
+            if (character === "\\") {
+                position += 2;
+                continue;
+            }
+            if (character === "(") {
+                depth++;
+            }
+            else if (character === ")") {
+                if (depth === 0) {
+                    break;
+                }
+                depth--;
+            }
+            position++;
+        }
+        if (depth !== 0 || position > limit) {
+            return null;
+        }
+        address = source.slice(addressStart, position);
+    }
+    skipSpaces();
+    const opener = source[position];
+    if (opener === '"' || opener === "'" || opener === "(") {
+        const close = findBeforeLimit(opener === "(" ? ")" : opener, position + 1);
+        if (close === -1) {
+            return null;
+        }
+        position = close + 1;
+        skipSpaces();
+    }
+    if (position >= limit || source[position] !== ")") {
+        return null;
+    }
+    return address.replace(ESCAPED_PUNCTUATION_PATTERN, "$1");
+};
+/*
+ * What each candidate place is taken to be when the lexer does not read the
+ * text (see "THE LEXER ONLY READS SHORT TEXT" above), in one pass: a "!["
+ * on a line indented as code, or in a code span of its own line, is code;
+ * a "![](" whose address can be read on its line before the next candidate
+ * is an image with that address. A diagram is decided by trusted code
+ * alone (see getEdits).
+ */
+const findWithoutLexing = (data) => {
+    const found = {
+        images: new Map(),
+        literal: new Set(),
+        diagrams: new Set(),
+    };
+    const images = [];
+    data.candidates.forEach((candidate, index) => {
+        if (candidate.kind === CandidateKind.Image) {
+            images.push(index);
+        }
+    });
+    /*
+     * The line of the last candidate, its code spans, and the first of them
+     * that does not end before that candidate: all only move forward, as the
+     * candidates do.
+     */
+    let lineIndex = 0;
+    let spansOfLine = -1;
+    let spans = [];
+    let spanIndex = 0;
+    images.forEach((index, order) => {
+        const position = data.candidates[index].position;
+        while (data.lines[lineIndex].end < position) {
+            lineIndex++;
+        }
+        const line = data.lines[lineIndex];
+        if (spansOfLine !== lineIndex) {
+            spans = getLineCodeSpans(data.source, line);
+            spansOfLine = lineIndex;
+            spanIndex = 0;
+        }
+        while (spanIndex < spans.length && spans[spanIndex][1] <= position) {
+            spanIndex++;
+        }
+        const span = spans[spanIndex];
+        if (INDENTED_LINE_PATTERN.test(data.source.slice(line.start, line.end)) ||
+            (span && span[0] < position)) {
+            found.literal.add(index);
+            return;
+        }
+        if (!data.source.startsWith("![](", position)) {
+            return;
+        }
+        const next = order + 1 < images.length
+            ? data.candidates[images[order + 1]]
+            : undefined;
+        const address = readImageAddress(data.source, position + 4, Math.min(line.end, next ? next.position : line.end, position + 4 + IMAGE_ADDRESS_SCAN_MAX_LENGTH));
+        if (address !== null) {
+            found.images.set(index, address);
+        }
+    });
+    return found;
+};
+/*
+ * The text of the link an image without alt text becomes: its address,
+ * shortened and escaped so it reads as typed, or a plain word when it has
+ * none.
+ */
+const getImageLinkLabel = (href) => {
+    const address = (href || "").replace(MARKER_PATTERN, "").trim();
+    if (!address) {
+        return IMAGE_LINK_FALLBACK_LABEL;
+    }
+    return escapeMarkdownInline(address.length > IMAGE_LINK_LABEL_MAX_LENGTH
+        ? `${address.slice(0, IMAGE_LINK_LABEL_MAX_LENGTH)}...`
+        : address);
+};
+// What changes one candidate place into something that does nothing.
+const getEdits = (data) => {
+    const position = data.candidate.position;
+    if (data.candidate.kind === CandidateKind.Mermaid) {
+        const info = data.candidate.info;
+        /*
+         * A fence the lexer found, or one every renderer reads as a fence, is
+         * given the language "text" when its language holds "mermaid"; every
+         * other "mermaid" is broken.
+         */
+        const isRenamed = (data.found.diagrams.has(data.index) ||
+            data.code.openingInfoStarts.has(info.start)) &&
+            info.mermaidWords[0] < info.languageEnd;
+        const edits = isRenamed
+            ? [
+                {
+                    position: info.start,
+                    deleteCount: info.languageEnd - info.start,
+                    insert: DEMOTED_LANGUAGE,
+                },
+            ]
+            : [];
+        for (const word of info.mermaidWords) {
+            if (!isRenamed || word >= info.languageEnd) {
+                edits.push({ position: word, deleteCount: 0, insert: WORD_JOINER });
+            }
+        }
+        return edits;
+    }
+    const isImage = data.found.images.has(data.index);
+    // In code or HTML a backslash would show; the joiner cannot be seen.
+    if (!isImage && data.found.literal.has(data.index)) {
+        return [{ position: position + 1, deleteCount: 0, insert: WORD_JOINER }];
+    }
+    const edits = [
+        { position: position, deleteCount: 0, insert: "\\" },
+    ];
+    /*
+     * "![]" - an image with no alt text, whose link would have no text to
+     * see or click. Only for an image found, whose address is known.
+     */
+    if (isImage && data.source.startsWith("![]", position)) {
+        edits.push({
+            position: position + 2,
+            deleteCount: 0,
+            insert: getImageLinkLabel(data.found.images.get(data.index)),
+        });
+    }
+    return edits;
+};
+/*
+ * The text with every edit made, in one pass from the start. An edit that
+ * falls inside text an earlier one replaced is dropped: that text is gone.
+ * At the same place a replacement comes first, and so wins.
+ */
+const applyEdits = (source, edits) => {
+    const ordered = [...edits].sort((a, b) => {
+        return a.position - b.position || b.deleteCount - a.deleteCount;
+    });
+    const parts = [];
+    let cursor = 0;
+    for (const edit of ordered) {
+        if (edit.position < cursor) {
+            continue;
+        }
+        parts.push(source.slice(cursor, edit.position), edit.insert);
+        cursor = edit.position + edit.deleteCount;
+    }
+    parts.push(source.slice(cursor));
+    return parts.join("");
+};
+/**
+ * The Markdown with every image turned into a link to the same address and
+ * every mermaid diagram into a plain code block, whatever renderer reads it
+ * (see above); everything else reads exactly as written. Text with neither
+ * comes back unchanged; otherwise its line endings come back as "\n".
+ * Linear in the text's length.
+ */
+export const neutralizeMarkdownImagesAndDiagrams = (markdown) => {
+    if (markdown === undefined || markdown === null) {
+        return "";
+    }
+    const original = String(markdown);
+    // As marked reads it, so a position here is a position in what it lexed.
+    const source = original.replace(/\r\n|\r/g, "\n");
+    const lines = splitLines(source);
+    const code = findTrustedCode(source, lines);
+    const candidates = findCandidates({
+        source: source,
+        lines: lines,
+        code: code,
+    });
+    // Nothing that could be an image or a diagram.
+    if (candidates.length === 0) {
+        return original;
+    }
+    let found = null;
+    if (source.length <= LEXED_TEXT_MAX_LENGTH) {
+        try {
+            found = findInProbe(source, candidates);
+        }
+        catch (_a) {
+            // Not read at all: decided as a longer text is.
+            found = null;
+        }
+    }
+    if (!found) {
+        found = findWithoutLexing({
+            source: source,
+            lines: lines,
+            candidates: candidates,
+        });
+    }
+    const foundInText = found;
+    return applyEdits(source, candidates.flatMap((candidate, index) => {
+        return getEdits({
+            source: source,
+            candidate: candidate,
+            index: index,
+            found: foundInText,
+            code: code,
+        });
+    }));
+};
+/**
+ * Both of the above, for Markdown an outsider wrote: no image or diagram
+ * that acts on its own, and no chat mention.
+ */
+export const neutralizeUntrustedMarkdown = (markdown) => {
+    return neutralizeChatControlSequences(neutralizeMarkdownImagesAndDiagrams(markdown));
+};
+/**
+ * Plain text an outsider wrote that other code places into Markdown as it
+ * is - an incident's title, which episode titles, feed items, chat
+ * messages and note templates take up raw. Its chat control sequences are
+ * broken as above, and so, with the same invisible word joiner, is every
+ * "![", every "]" that a link or a link definition would go on from, and
+ * every "mermaid" after a fence run: wherever the text lands - even beside
+ * other Markdown - no renderer finds a mention, an image or a diagram in it,
+ * or a reference that completes one. It reads exactly as typed - in
+ * Markdown, and as plain text in an email subject or a text message.
+ * Idempotent.
+ */
+export const neutralizeUntrustedPlainText = (value) => {
+    if (value === undefined || value === null) {
+        return "";
+    }
+    /*
+     * Also "]" before "(", "[" or ":": joined to other Markdown - an episode
+     * template puts the title and the description side by side - a title
+     * could otherwise define the link reference an image in the description
+     * reads ("[a]: https://tracker.example/p.png"), or complete one opened
+     * there.
+     */
+    const text = neutralizeChatControlSequences(value)
+        .replace(IMAGE_OPENER_PATTERN, `!${WORD_JOINER}`)
+        .replace(LINK_TAIL_OPENER_PATTERN, `]${WORD_JOINER}`);
+    return applyEdits(text, findDiagramInfoStrings(text, splitLines(text)).flatMap((info) => {
+        return info.mermaidWords.map((word) => {
+            return { position: word, deleteCount: 0, insert: WORD_JOINER };
+        });
+    }));
+};
+//# sourceMappingURL=UntrustedMarkdown.js.map