securemark 0.223.0 → 0.224.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.224.0
+
+- Change media parser to disallow relative paths.
+
 ## 0.223.0
 
 - Refine some parsers to allow and trim leading whitespace.

package/dist/securemark.js

@@ -1,4 +1,4 @@
-/*! securemark v0.223.0 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED */
+/*! securemark v0.224.0 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED */
 require = function () {
     function r(e, n, t) {
         function o(i, f) {
@@ -6625,7 +6625,7 @@ require = function () {
             exports.annotation = (0, combinator_1.lazy)(() => (0, combinator_1.creator)((0, combinator_1.validate)('((', '))', '\n', (0, combinator_1.fmap)((0, combinator_1.surround)('((', (0, combinator_1.guard)(context => {
                 var _a, _b, _c;
                 return (_c = (_b = (_a = context.syntax) === null || _a === void 0 ? void 0 : _a.inline) === null || _b === void 0 ? void 0 : _b.annotation) !== null && _c !== void 0 ? _c : true;
-            }, (0, util_1.startLoose)((0, util_1.visible)((0, combinator_1.context)({
+            }, (0, util_1.startLoose)((0, combinator_1.context)({
                 syntax: {
                     inline: {
                         annotation: false,
@@ -6633,7 +6633,7 @@ require = function () {
                     }
                 },
                 state: global_1.undefined
-            }, (0, combinator_1.union)([(0, combinator_1.some)(inline_1.inline, ')', /^\\?\n/)]))))), '))'), ns => [(0, typed_dom_1.html)('sup', { class: 'annotation' }, (0, util_1.trimNode)((0, typed_dom_1.defrag)(ns)))]))));
+            }, (0, combinator_1.union)([(0, combinator_1.some)(inline_1.inline, ')', /^\\?\n/)])), '))')), '))'), ns => [(0, typed_dom_1.html)('sup', { class: 'annotation' }, (0, util_1.trimNode)((0, typed_dom_1.defrag)(ns)))]))));
         },
         {
             '../../combinator': 30,
@@ -7485,7 +7485,7 @@ require = function () {
                     [(0, typed_dom_1.html)(tag, attributes('html', [], attrspec[tag], as))],
                     rest
                 ]), ([, tag]) => tag)),
-                (0, combinator_1.match)(/^(?=<(sup|sub|small|bdo|bdi)(?=[^\S\n]|>))/, (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.validate)(`<${ tag }`, `</${ tag }>`, (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${ tag }`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)('>'), true), (0, util_1.startLoose)((0, util_1.visible)((0, combinator_1.context)((() => {
+                (0, combinator_1.match)(/^(?=<(sup|sub|small|bdo|bdi)(?=[^\S\n]|>))/, (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.validate)(`<${ tag }`, `</${ tag }>`, (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${ tag }`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)('>'), true), (0, util_1.startLoose)((0, combinator_1.context)((() => {
                     switch (tag) {
                     case 'sup':
                     case 'sub':
@@ -7507,11 +7507,11 @@ require = function () {
                     default:
                         return {};
                     }
-                })(), (0, combinator_1.some)((0, combinator_1.union)([inline_1.inline]), `</${ tag }>`)))), (0, source_1.str)(`</${ tag }>`), false, ([as, bs, cs], rest, context) => [
+                })(), (0, combinator_1.some)((0, combinator_1.union)([inline_1.inline]), `</${ tag }>`)), `</${ tag }>`), (0, source_1.str)(`</${ tag }>`), false, ([as, bs, cs], rest, context) => [
                     [elem(tag, as, (0, util_1.trimEndBR)((0, typed_dom_1.defrag)(bs)), cs, context)],
                     rest
                 ])), ([, tag]) => tag)),
-                (0, combinator_1.match)(/^(?=<([a-z]+)(?=[^\S\n]|>))/, (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.validate)(`<${ tag }`, `</${ tag }>`, (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${ tag }`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)('>'), true), (0, util_1.startLoose)((0, util_1.visible)((0, combinator_1.some)((0, combinator_1.union)([inline_1.inline]), `</${ tag }>`))), (0, source_1.str)(`</${ tag }>`), false, ([as, bs, cs], rest) => [
+                (0, combinator_1.match)(/^(?=<([a-z]+)(?=[^\S\n]|>))/, (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.validate)(`<${ tag }`, `</${ tag }>`, (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${ tag }`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)('>'), true), (0, util_1.startLoose)((0, combinator_1.some)((0, combinator_1.union)([inline_1.inline]), `</${ tag }>`), `</${ tag }>`), (0, source_1.str)(`</${ tag }>`), false, ([as, bs, cs], rest) => [
                     [elem(tag, as, (0, util_1.trimEndBR)((0, typed_dom_1.defrag)(bs)), cs, {})],
                     rest
                 ], ([as, bs], rest) => as.length === 1 ? [
@@ -7529,14 +7529,14 @@ require = function () {
                 case 'sub':
                     switch (true) {
                     case (_b = (_a = context.state) === null || _a === void 0 ? void 0 : _a.in) === null || _b === void 0 ? void 0 : _b.supsub:
-                        return invalid('nest', `<${ tag }> HTML tag cannot be used in <sup>/<sub> HTML tags.`, as, bs, cs);
+                        return invalid('nest', `<${ tag }> HTML tag cannot be used in <sup> or <sub> HTML tag.`, as, bs, cs);
                     }
                     break;
                 case 'small':
                     switch (true) {
                     case (_d = (_c = context.state) === null || _c === void 0 ? void 0 : _c.in) === null || _d === void 0 ? void 0 : _d.supsub:
                     case (_f = (_e = context.state) === null || _e === void 0 ? void 0 : _e.in) === null || _f === void 0 ? void 0 : _f.small:
-                        return invalid('nest', `<${ tag }> HTML tag cannot be used in <sup>/<sub>/<small> HTML tags.`, as, bs, cs);
+                        return invalid('nest', `<${ tag }> HTML tag cannot be used in <sup>, <sub>, or <small> HTML tag.`, as, bs, cs);
                     }
                     break;
                 }
@@ -7672,7 +7672,7 @@ require = function () {
                 (0, combinator_1.context)({ syntax: { inline: { link: false } } }, (0, combinator_1.dup)((0, combinator_1.union)([
                     (0, combinator_1.surround)('[', inline_1.media, ']'),
                     (0, combinator_1.surround)('[', inline_1.shortmedia, ']'),
-                    (0, combinator_1.surround)('[', (0, util_1.startLoose)((0, util_1.visible)((0, combinator_1.context)({
+                    (0, combinator_1.surround)('[', (0, util_1.startLoose)((0, combinator_1.context)({
                         syntax: {
                             inline: {
                                 annotation: false,
@@ -7683,18 +7683,18 @@ require = function () {
                                 autolink: false
                             }
                         }
-                    }, (0, combinator_1.some)(inline_1.inline, ']', /^\\?\n/)))), ']', true)
+                    }, (0, combinator_1.some)(inline_1.inline, ']', /^\\?\n/)), ']'), ']', true)
                 ]))),
                 (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([
                     exports.uri,
                     (0, combinator_1.some)(exports.option)
                 ]), /^[^\S\n]?}/))
             ])))), ([params, content = []], rest, context) => {
-                var _a, _b;
+                var _a, _b, _c, _d, _e;
                 if ((0, parser_1.eval)((0, combinator_1.some)(autolink_1.autolink)((0, util_1.stringify)(content), context), []).some(node => typeof node === 'object'))
                     return;
                 const INSECURE_URI = params.shift();
-                const el = create(INSECURE_URI, (0, util_1.trimNode)((0, typed_dom_1.defrag)(content)), new url_1.ReadonlyURL(resolve(INSECURE_URI, context.host || global_1.location, context.url || global_1.location), ((_a = context.host) === null || _a === void 0 ? void 0 : _a.href) || global_1.location.href), ((_b = context.host) === null || _b === void 0 ? void 0 : _b.origin) || global_1.location.origin);
+                const el = create(INSECURE_URI, (0, util_1.trimNode)((0, typed_dom_1.defrag)(content)), new url_1.ReadonlyURL(resolve(INSECURE_URI, (_a = context.host) !== null && _a !== void 0 ? _a : global_1.location, (_c = (_b = context.url) !== null && _b !== void 0 ? _b : context.host) !== null && _c !== void 0 ? _c : global_1.location), ((_d = context.host) === null || _d === void 0 ? void 0 : _d.href) || global_1.location.href), ((_e = context.host) === null || _e === void 0 ? void 0 : _e.origin) || global_1.location.origin);
                 if (el.classList.contains('invalid'))
                     return [
                         [el],
@@ -7716,40 +7716,41 @@ require = function () {
                 (0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[^\n{}]+/), opt => [` \\${ opt.slice(1) }`])
             ]);
             function resolve(uri, host, source) {
-                var _a;
                 switch (true) {
                 case uri.slice(0, 2) === '^/':
-                    const file = host.pathname.slice(host.pathname.lastIndexOf('/') + 1);
-                    return file.includes('.') ? `${ host.pathname.slice(0, -file.length) }${ uri.slice(2) }` : `${ fillTrailingSlash(host.pathname) }${ uri.slice(2) }`;
+                    const last = host.pathname.slice(host.pathname.lastIndexOf('/') + 1);
+                    return last.includes('.') && /^[0-9]*[a-z][0-9a-z]*$/i.test(last.slice(last.lastIndexOf('.') + 1)) ? `${ host.pathname.slice(0, -last.length) }${ uri.slice(2) }` : `${ host.pathname.replace(/\/?$/, '/') }${ uri.slice(2) }`;
                 case host.origin === source.origin && host.pathname === source.pathname:
                 case uri.slice(0, 2) === '//':
                     return uri;
                 default:
                     const target = new url_1.ReadonlyURL(uri, source.href);
-                    return target.origin === ((_a = uri.match(/^[A-Za-z][0-9A-Za-z.+-]*:\/\/[^/?#]*/)) === null || _a === void 0 ? void 0 : _a[0]) ? uri : target.origin === host.origin ? target.href.slice(target.origin.length) : target.href;
+                    return target.origin === host.origin ? target.href.slice(target.origin.length) : target.href;
                 }
             }
             exports.resolve = resolve;
-            function fillTrailingSlash(pathname) {
-                return pathname[pathname.length - 1] === '/' ? pathname : pathname + '/';
-            }
-            function create(address, content, uri, origin) {
+            function create(INSECURE_URI, content, uri, origin) {
                 let type;
                 let description;
                 switch (uri.protocol) {
                 case 'http:':
                 case 'https:':
+                    if (INSECURE_URI.slice(0, 2) === '^/' && /(?:\/\.\.?)(?:\/|$)/.test(INSECURE_URI.slice(0, INSECURE_URI.search(/[?#]|$/)))) {
+                        type = 'argument';
+                        description = 'Subresource paths cannot contain dot-segments.';
+                        break;
+                    }
                     return (0, typed_dom_1.html)('a', {
                         href: uri.source,
                         target: undefined || uri.origin !== origin || typeof content[0] === 'object' && content[0].classList.contains('media') ? '_blank' : undefined
-                    }, content.length === 0 ? decode(address) : content);
+                    }, content.length === 0 ? decode(INSECURE_URI) : content);
                 case 'tel:':
                     if (content.length === 0) {
-                        content = [address];
+                        content = [INSECURE_URI];
                     }
                     const pattern = /^(?:tel:)?(?:\+(?!0))?\d+(?:-\d+)*$/i;
                     switch (true) {
-                    case content.length === 1 && typeof content[0] === 'string' && pattern.test(address) && pattern.test(content[0]) && address.replace(/[^+\d]/g, '') === content[0].replace(/[^+\d]/g, ''):
+                    case content.length === 1 && typeof content[0] === 'string' && pattern.test(INSECURE_URI) && pattern.test(content[0]) && INSECURE_URI.replace(/[^+\d]/g, '') === content[0].replace(/[^+\d]/g, ''):
                         return (0, typed_dom_1.html)('a', { href: uri.source }, content);
                     }
                     type = 'content';
@@ -7761,7 +7762,7 @@ require = function () {
                     'data-invalid-syntax': 'link',
                     'data-invalid-type': type !== null && type !== void 0 ? type : type = 'argument',
                     'data-invalid-description': description !== null && description !== void 0 ? description : description = 'Invalid protocol.'
-                }, content.length === 0 ? address : content);
+                }, content.length === 0 ? INSECURE_URI : content);
             }
             function decode(uri) {
                 if (uri.indexOf('%') === -1)
@@ -7907,24 +7908,23 @@ require = function () {
                 [''],
                 as
             ]), ([[text]]) => text === '' || text.trim() !== ''), ([[text], params], rest, context) => {
-                var _a, _b, _c, _d;
+                var _a, _b, _c, _d, _e, _f, _g, _h, _j;
                 const INSECURE_URI = params.shift();
-                const url = new url_1.ReadonlyURL((0, link_1.resolve)(INSECURE_URI, context.host || global_1.location, context.url || global_1.location), ((_a = context.host) === null || _a === void 0 ? void 0 : _a.href) || global_1.location.href);
-                const cache = (_b = context.caches) === null || _b === void 0 ? void 0 : _b.media;
-                const cached = cache === null || cache === void 0 ? void 0 : cache.has(url.href);
-                const el = cache && cached ? cache.get(url.href).cloneNode(true) : (0, typed_dom_1.html)('img', {
+                const url = new url_1.ReadonlyURL((0, link_1.resolve)(INSECURE_URI, (_a = context.host) !== null && _a !== void 0 ? _a : global_1.location, (_c = (_b = context.url) !== null && _b !== void 0 ? _b : context.host) !== null && _c !== void 0 ? _c : global_1.location), ((_d = context.host) === null || _d === void 0 ? void 0 : _d.href) || global_1.location.href);
+                let cache;
+                const el = global_1.undefined || (cache = (_g = (_f = (_e = context.caches) === null || _e === void 0 ? void 0 : _e.media) === null || _f === void 0 ? void 0 : _f.get(url.href)) === null || _g === void 0 ? void 0 : _g.cloneNode(true)) || (0, typed_dom_1.html)('img', {
                     class: 'media',
                     'data-src': url.source,
                     alt: text
                 });
-                if (!cached && !sanitize(url, el))
+                if (!cache && !sanitize(url, el))
                     return [
                         [el],
                         rest
                     ];
-                cached && el.hasAttribute('alt') && el.setAttribute('alt', text);
+                (cache === null || cache === void 0 ? void 0 : cache.hasAttribute('alt')) && (cache === null || cache === void 0 ? void 0 : cache.setAttribute('alt', text));
                 (0, typed_dom_1.define)(el, (0, html_1.attributes)('media', (0, array_1.push)([], el.classList), optspec, params));
-                if (((_d = (_c = context.syntax) === null || _c === void 0 ? void 0 : _c.inline) === null || _d === void 0 ? void 0 : _d.link) === false || cached && el.tagName !== 'IMG')
+                if (((_j = (_h = context.syntax) === null || _h === void 0 ? void 0 : _h.inline) === null || _j === void 0 ? void 0 : _j.link) === false || cache && cache.tagName !== 'IMG')
                     return [
                         [el],
                         rest
@@ -7970,18 +7970,29 @@ require = function () {
                 link_1.option
             ]);
             function sanitize(uri, target) {
+                if (/^\.\.?\//.test(uri.source)) {
+                    (0, typed_dom_1.define)(target, {
+                        class: void target.classList.add('invalid'),
+                        'data-invalid-syntax': 'media',
+                        'data-invalid-type': 'argument',
+                        'data-invalid-description': 'Relative paths cannot be used with media syntax; Use subresource paths instead.'
+                    });
+                    return false;
+                }
                 switch (uri.protocol) {
                 case 'http:':
                 case 'https:':
-                    return true;
+                    break;
+                default:
+                    (0, typed_dom_1.define)(target, {
+                        class: void target.classList.add('invalid'),
+                        'data-invalid-syntax': 'media',
+                        'data-invalid-type': 'argument',
+                        'data-invalid-description': 'Invalid protocol.'
+                    });
+                    return false;
                 }
-                (0, typed_dom_1.define)(target, {
-                    class: void target.classList.add('invalid'),
-                    'data-invalid-syntax': 'media',
-                    'data-invalid-type': 'argument',
-                    'data-invalid-description': 'Invalid protocol.'
-                });
-                return false;
+                return true;
             }
         },
         {
@@ -8011,7 +8022,7 @@ require = function () {
             exports.reference = (0, combinator_1.lazy)(() => (0, combinator_1.creator)((0, combinator_1.validate)('[[', ']]', '\n', (0, combinator_1.fmap)((0, combinator_1.surround)('[[', (0, combinator_1.guard)(context => {
                 var _a, _b, _c;
                 return (_c = (_b = (_a = context.syntax) === null || _a === void 0 ? void 0 : _a.inline) === null || _b === void 0 ? void 0 : _b.reference) !== null && _c !== void 0 ? _c : true;
-            }, (0, util_1.startLoose)((0, util_1.visible)((0, combinator_1.context)({
+            }, (0, util_1.startLoose)((0, combinator_1.context)({
                 syntax: {
                     inline: {
                         annotation: false,
@@ -8030,8 +8041,8 @@ require = function () {
                     ''
                 ]),
                 (0, combinator_1.some)(inline_1.inline, ']', /^\\?\n/)
-            ]))))), ']]'), ns => [(0, typed_dom_1.html)('sup', attributes(ns), (0, util_1.trimNode)((0, typed_dom_1.defrag)(ns)))]))));
-            const abbr = (0, combinator_1.creator)((0, combinator_1.fmap)((0, combinator_1.verify)((0, combinator_1.surround)('^', (0, combinator_1.union)([(0, source_1.str)(/^(?![0-9]+\s?[|\]])[0-9A-Za-z]+(?:(?:-|(?=\W)(?!'\d)'?(?!\.\d)\.?(?!,\S),? ?)[0-9A-Za-z]+)*(?:-|'?\.?,? ?)?/)]), /^\|?(?=]])|^\|[^\S\n]+/), (_, rest, context) => (0, util_1.isStartTight)(rest, context)), ([source]) => [(0, typed_dom_1.html)('abbr', source)]));
+            ])), ']]')), ']]'), ns => [(0, typed_dom_1.html)('sup', attributes(ns), (0, util_1.trimNode)((0, typed_dom_1.defrag)(ns)))]))));
+            const abbr = (0, combinator_1.creator)((0, combinator_1.fmap)((0, combinator_1.verify)((0, combinator_1.surround)('^', (0, combinator_1.union)([(0, source_1.str)(/^(?![0-9]+\s?[|\]])[0-9A-Za-z]+(?:(?:-|(?=\W)(?!'\d)'?(?!\.\d)\.?(?!,\S),? ?)[0-9A-Za-z]+)*(?:-|'?\.?,? ?)?/)]), /^\|?(?=]])|^\|[^\S\n]/), (_, rest, context) => (0, util_1.isStartLoose)(rest, context)), ([source]) => [(0, typed_dom_1.html)('abbr', source)]));
             function attributes(ns) {
                 return typeof ns[0] === 'object' && ns[0].tagName === 'ABBR' ? {
                     class: 'reference',
@@ -8942,7 +8953,7 @@ require = function () {
         function (_dereq_, module, exports) {
             'use strict';
             Object.defineProperty(exports, '__esModule', { value: true });
-            exports.stringify = exports.trimEndBR = exports.trimNodeEnd = exports.trimNode = exports.visible = exports.isEndTightNodes = exports.isStartTightNodes = exports.isStartTight = exports.startTight = exports.startLoose = exports.visualize = void 0;
+            exports.stringify = exports.trimEndBR = exports.trimNodeEnd = exports.trimNode = exports.isEndTightNodes = exports.isStartTightNodes = exports.startTight = exports.isStartLoose = exports.startLoose = exports.visualize = void 0;
             const global_1 = _dereq_('spica/global');
             const parser_1 = _dereq_('../combinator/data/parser');
             const combinator_1 = _dereq_('../combinator');
@@ -9017,15 +9028,18 @@ require = function () {
                 }
                 return false;
             }
-            function startLoose(parser) {
-                return (source, context) => isStartLoose(source, context) ? parser(source, context) : global_1.undefined;
+            function startLoose(parser, except) {
+                return (source, context) => isStartLoose(source, context, except) ? parser(source, context) : global_1.undefined;
             }
             exports.startLoose = startLoose;
-            function isStartLoose(source, context) {
+            function isStartLoose(source, context, except) {
+                var _a;
+                source && (source = source.replace(/^[^\S\n]+/, ''));
                 if (source === '')
                     return true;
-                return isStartTight(source.replace(/^[^\S\n]+/, ''), context);
+                return source.slice(0, (_a = except === null || except === void 0 ? void 0 : except.length) !== null && _a !== void 0 ? _a : 0) !== except && isStartTight(source, context);
             }
+            exports.isStartLoose = isStartLoose;
             function startTight(parser) {
                 return (source, context) => isStartTight(source, context) ? parser(source, context) : global_1.undefined;
             }
@@ -9064,7 +9078,6 @@ require = function () {
                     return source[0].trimStart() !== '';
                 }
             }
-            exports.isStartTight = isStartTight;
             function isStartTightNodes(nodes) {
                 if (nodes.length === 0)
                     return true;
@@ -9078,18 +9091,6 @@ require = function () {
                 return typeof nodes[last] === 'string' && nodes[last].length > 1 ? isVisible(nodes[last], -1) || isVisible(nodes[last], -2) : isVisible(nodes[last], -1) || last === 0 || isVisible(nodes[last - 1], -1);
             }
             exports.isEndTightNodes = isEndTightNodes;
-            function visible(parser) {
-                return (0, combinator_1.verify)(parser, nodes => {
-                    if (nodes.length === 0)
-                        return true;
-                    for (let i = 0; i < nodes.length; ++i) {
-                        if (isVisible(nodes[i]))
-                            return true;
-                    }
-                    return false;
-                });
-            }
-            exports.visible = visible;
             function isVisible(node, position) {
                 if (!node)
                     return false;
@@ -9216,8 +9217,6 @@ require = function () {
             }));
             function render(source, opts = {}) {
                 opts = extend(opts);
-                if (source.classList.contains('invalid'))
-                    return;
                 const base = global_1.location.href;
                 if (source.matches(selector))
                     return void render_(base, source, opts);
@@ -9228,6 +9227,8 @@ require = function () {
             exports.render = render;
             function render_(base, source, opts) {
                 var _a, _b, _c;
+                if (source.classList.contains('invalid'))
+                    return;
                 try {
                     switch (true) {
                     case !!opts.code && !source.firstElementChild && source.matches('pre.code'):

package/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.223.0",
+  "version": "0.224.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -399,9 +399,9 @@
       }
     },
     "@npmcli/fs": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-1.0.0.tgz",
-      "integrity": "sha512-8ltnOpRR/oJbOp8vaGUnipOi3bqkcW+sLHFlyXIr08OGHmVJLB1Hn7QtGXbYcpVtH1gAYZTlmDXtE4YV0+AMMQ==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-1.1.0.tgz",
+      "integrity": "sha512-VhP1qZLXcrXRIaPoqb4YA55JQxLNF3jNR4T55IdOJa3+IFJKNYHtPvtXx8slmeMavj37vCzCfrqQM1vWLsYKLA==",
       "dev": true,
       "requires": {
         "@gar/promisify": "^1.0.1",
@@ -1338,21 +1338,21 @@
       "dev": true
     },
     "body-parser": {
-      "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.0.tgz",
-      "integrity": "sha512-dhEPs72UPbDnAQJ9ZKMNTP6ptJaionhP5cBb541nXPlW60Jepo9RV/a4fX4XWW9CuFNK22krhrj1+rgzifNCsw==",
+      "version": "1.19.1",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.1.tgz",
+      "integrity": "sha512-8ljfQi5eBk8EJfECMrgqNGWPEY5jWP+1IzkzkGdFFEwFQZZyaZ21UqdaHktgiMlH0xLHqIFtE/u2OYE5dOtViA==",
       "dev": true,
       "requires": {
-        "bytes": "3.1.0",
+        "bytes": "3.1.1",
         "content-type": "~1.0.4",
         "debug": "2.6.9",
         "depd": "~1.1.2",
-        "http-errors": "1.7.2",
+        "http-errors": "1.8.1",
         "iconv-lite": "0.4.24",
         "on-finished": "~2.3.0",
-        "qs": "6.7.0",
-        "raw-body": "2.4.0",
-        "type-is": "~1.6.17"
+        "qs": "6.9.6",
+        "raw-body": "2.4.2",
+        "type-is": "~1.6.18"
       }
     },
     "boxen": {
@@ -1672,9 +1672,9 @@
       "dev": true
     },
     "bytes": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-      "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.1.tgz",
+      "integrity": "sha512-dWe4nWO/ruEOY7HkUJ5gFt1DCFV9zPRoJr8pV0/ASQermOZjtq8jMjOprC0Kd10GLN+l7xaUPvxzJFWtxGu8Fg==",
       "dev": true
     },
     "cacache": {
@@ -2887,9 +2887,9 @@
       "dev": true
     },
     "electron-to-chromium": {
-      "version": "1.4.14",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.14.tgz",
-      "integrity": "sha512-RsGkAN9JEAYMObS72kzUsPPcPGMqX1rBqGuXi9aa4TBKLzICoLf+DAAtd0fVFzrniJqYzpby47gthCUoObfs0Q==",
+      "version": "1.4.16",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.16.tgz",
+      "integrity": "sha512-BQb7FgYwnu6haWLU63/CdVW+9xhmHls3RCQUFiV4lvw3wimEHTVcUk2hkuZo76QhR8nnDdfZE7evJIZqijwPdA==",
       "dev": true
     },
     "elliptic": {
@@ -5153,24 +5153,16 @@
       "dev": true
     },
     "http-errors": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
-      "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
       "dev": true,
       "requires": {
         "depd": "~1.1.2",
-        "inherits": "2.0.3",
-        "setprototypeof": "1.1.1",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
         "statuses": ">= 1.5.0 < 2",
-        "toidentifier": "1.0.0"
-      },
-      "dependencies": {
-        "inherits": {
-          "version": "2.0.3",
-          "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-          "integrity": "sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4=",
-          "dev": true
-        }
+        "toidentifier": "1.0.1"
       }
     },
     "http-proxy": {
@@ -5621,9 +5613,9 @@
       "dev": true
     },
     "is-negative-zero": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.1.tgz",
-      "integrity": "sha512-2z6JzQvZRa9A2Y7xC6dQQm4FSTSTNWjKIYYTt4246eMTJmIo0Q+ZyOsU66X8lxK1AbB92dFeglPLrhwpeRKO6w==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.2.tgz",
+      "integrity": "sha512-dqJvarLawXsFbNDeJW7zAz8ItJ9cd28YufuuFzh0G8pNHjJMnY08Dv7sYX2uF5UpQOwieAeOExEYAWWfu7ZZUA==",
       "dev": true
     },
     "is-npm": {
@@ -5782,12 +5774,12 @@
       "dev": true
     },
     "is-weakref": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.0.1.tgz",
-      "integrity": "sha512-b2jKc2pQZjaeFYWEf7ScFj+Be1I+PXmlu572Q8coTXZ+LD/QQZ7ShPMst8h16riVgyXTQwUsFEl74mDvc/3MHQ==",
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.0.2.tgz",
+      "integrity": "sha512-qctsuLZmIQ0+vSSMfoVvyFe2+GSEvnmZ2ezTup1SBse9+twCCeial6EEi3Nc2KFcf6+qz2FBPnjXsk8xhKSaPQ==",
       "dev": true,
       "requires": {
-        "call-bind": "^1.0.0"
+        "call-bind": "^1.0.2"
       }
     },
     "is-windows": {
@@ -6854,9 +6846,9 @@
       "dev": true
     },
     "minipass": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.1.5.tgz",
-      "integrity": "sha512-+8NzxD82XQoNKNrl1d/FSi+X8wAEWR+sbYAfIvub4Nz0d22plFG72CEVVaufV8PNf4qSslFTD8VMOxNVhHCjTw==",
+      "version": "3.1.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.1.6.tgz",
+      "integrity": "sha512-rty5kpw9/z8SX9dmxblFA6edItUmwJgMeYDZRrwlIVN27i8gysGbznJwUggw2V/FVqFSDdWy040ZPS811DYAqQ==",
       "dev": true,
       "requires": {
         "yallist": "^4.0.0"
@@ -8367,9 +8359,9 @@
       "dev": true
     },
     "qs": {
-      "version": "6.7.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.7.0.tgz",
-      "integrity": "sha512-VCdBRNFTX1fyE7Nb6FYoURo/SPe62QCaAyzJvUjwRaIsc+NePBEniHlvxFmmX56+HZphIGtV0XeCirBtpDrTyQ==",
+      "version": "6.9.6",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.9.6.tgz",
+      "integrity": "sha512-TIRk4aqYLNoJUbd+g2lEdz5kLWIuTMRagAXxl78Q0RiVjAOugHmeKNGdd3cwo/ktpf9aL9epCfFqWDEKysUlLQ==",
       "dev": true
     },
     "querystring": {
@@ -8416,13 +8408,13 @@
       "dev": true
     },
     "raw-body": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.0.tgz",
-      "integrity": "sha512-4Oz8DUIwdvoa5qMJelxipzi/iJIi40O5cGV1wNYp5hvZP8ZN0T+jiNkL0QepXs+EsQ9XJ8ipEDoiH70ySUJP3Q==",
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.2.tgz",
+      "integrity": "sha512-RPMAFUJP19WIet/99ngh6Iv8fzAbqum4Li7AD6DtGaW2RpMB/11xDoalPiJMTbu6I3hkbMVkATvZrqb9EEqeeQ==",
       "dev": true,
       "requires": {
-        "bytes": "3.1.0",
-        "http-errors": "1.7.2",
+        "bytes": "3.1.1",
+        "http-errors": "1.8.1",
         "iconv-lite": "0.4.24",
         "unpipe": "1.0.0"
       }
@@ -9067,9 +9059,9 @@
       }
     },
     "setprototypeof": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.1.1.tgz",
-      "integrity": "sha512-JvdAWfbXeIGaZ9cILp38HntZSFSo3mWg6xGcJJsd+d4aRMOqauag1C63dJfDw7OaMYwEbHMOxEZ1lqVRYP2OAw==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
       "dev": true
     },
     "sha.js": {
@@ -9888,9 +9880,9 @@
       }
     },
     "toidentifier": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.0.tgz",
-      "integrity": "sha512-yaOH/Pk/VEhBWWTlhI+qXxDFXlejDGcQipMlyxda9nthulaxLZUNcUqFxokp0vcYnvteJln5FNQDRrxj3YcbVw==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
       "dev": true
     },
     "transformify": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.223.0",
+  "version": "0.224.0",
   "description": "Secure markdown renderer working on browsers for user input data.",
   "private": false,
   "homepage": "https://github.com/falsandtru/securemark",

package/src/parser/api/parse.test.ts

@@ -104,10 +104,6 @@ describe('Unit: parser/api/parse', () => {
           '{a}',
           '{/a}',
           '{^/a}',
-          '{^/a/..}',
-          '{^/a/../}',
-          '{^/a?/../}',
-          '{^/a#/../}',
           '{./a}',
           '{../a}',
           '{../../a}',
@@ -131,10 +127,6 @@ describe('Unit: parser/api/parse', () => {
           '<p><a href="https://source/x/a" target="_blank">a</a></p>',
           '<p><a href="https://source/a" target="_blank">/a</a></p>',
           '<p><a href="/z/a">^/a</a></p>',
-          '<p><a href="/z/a/..">^/a/..</a></p>',
-          '<p><a href="/z/a/../">^/a/../</a></p>',
-          '<p><a href="/z/a?/../">^/a?/../</a></p>',
-          '<p><a href="/z/a#/../">^/a#/../</a></p>',
           '<p><a href="https://source/x/a" target="_blank">./a</a></p>',
           '<p><a href="https://source/a" target="_blank">../a</a></p>',
           '<p><a href="https://source/a" target="_blank">../../a</a></p>',

package/src/parser/inline/annotation.ts

@@ -2,13 +2,13 @@ import { undefined } from 'spica/global';
 import { AnnotationParser } from '../inline';
 import { union, some, validate, guard, context, creator, surround, lazy, fmap } from '../../combinator';
 import { inline } from '../inline';
-import { startLoose, visible, trimNode } from '../util';
+import { startLoose, trimNode } from '../util';
 import { html, defrag } from 'typed-dom';
 
 export const annotation: AnnotationParser = lazy(() => creator(validate('((', '))', '\n', fmap(surround(
   '((',
   guard(context => context.syntax?.inline?.annotation ?? true,
-  startLoose(visible(
+  startLoose(
   context({ syntax: { inline: {
     annotation: false,
     // Redundant
@@ -20,6 +20,6 @@ export const annotation: AnnotationParser = lazy(() => creator(validate('((', ')
     //link: true,
     //autolink: true,
   }}, state: undefined },
-  union([some(inline, ')', /^\\?\n/)]))))),
+  union([some(inline, ')', /^\\?\n/)])), '))')),
   '))'),
   ns => [html('sup', { class: 'annotation' }, trimNode(defrag(ns)))]))));

package/src/parser/inline/html.ts

@@ -5,7 +5,7 @@ import { HTMLParser } from '../inline';
 import { union, some, validate, context, creator, surround, match, lazy } from '../../combinator';
 import { inline } from '../inline';
 import { str } from '../source';
-import { startLoose, visible, trimEndBR } from '../util';
+import { startLoose, trimEndBR } from '../util';
 import { html as h, defrag } from 'typed-dom';
 import { memoize } from 'spica/memoize';
 import { Cache } from 'spica/cache';
@@ -39,7 +39,7 @@ export const html: HTMLParser = lazy(() => creator(validate('<', '>', '\n', vali
       validate(`<${tag}`, `</${tag}>`,
       surround<HTMLParser.TagParser, string>(surround(
         str(`<${tag}`), some(attribute), str('>'), true),
-        startLoose(visible(
+        startLoose(
         context((() => {
           switch (tag) {
             case 'sup':
@@ -63,7 +63,7 @@ export const html: HTMLParser = lazy(() => creator(validate('<', '>', '\n', vali
               return {};
           }
         })(),
-        some(union([inline]), `</${tag}>`)))),
+        some(union([inline]), `</${tag}>`)), `</${tag}>`),
         str(`</${tag}>`), false,
         ([as, bs, cs], rest, context) =>
           [[elem(tag, as, trimEndBR(defrag(bs)), cs, context)], rest])),
@@ -75,7 +75,7 @@ export const html: HTMLParser = lazy(() => creator(validate('<', '>', '\n', vali
       validate(`<${tag}`, `</${tag}>`,
       surround<HTMLParser.TagParser, string>(surround(
         str(`<${tag}`), some(attribute), str('>'), true),
-        startLoose(visible(some(union([inline]), `</${tag}>`))),
+        startLoose(some(union([inline]), `</${tag}>`), `</${tag}>`),
         str(`</${tag}>`), false,
         ([as, bs, cs], rest) =>
           [[elem(tag, as, trimEndBR(defrag(bs)), cs, {})], rest],
@@ -99,14 +99,14 @@ function elem(tag: string, as: (HTMLElement | string)[], bs: (HTMLElement | stri
     case 'sub':
       switch (true) {
         case context.state?.in?.supsub:
-          return invalid('nest', `<${tag}> HTML tag cannot be used in <sup>/<sub> HTML tags.`, as, bs, cs);
+          return invalid('nest', `<${tag}> HTML tag cannot be used in <sup> or <sub> HTML tag.`, as, bs, cs);
       }
       break;
     case 'small':
       switch (true) {
         case context.state?.in?.supsub:
         case context.state?.in?.small:
-          return invalid('nest', `<${tag}> HTML tag cannot be used in <sup>/<sub>/<small> HTML tags.`, as, bs, cs);
+          return invalid('nest', `<${tag}> HTML tag cannot be used in <sup>, <sub>, or <small> HTML tag.`, as, bs, cs);
       }
       break;
   }

package/src/parser/inline/link.test.ts

@@ -1,10 +1,11 @@
 import { link } from './link';
 import { some } from '../../combinator';
 import { inspect } from '../../debug.test';
+import { MarkdownParser } from '../../../markdown';
 
 describe('Unit: parser/inline/link', () => {
   describe('link', () => {
-    const parser = (source: string) => some(link)(source, {});
+    const parser = (source: string, context: MarkdownParser.Context = {}) => some(link)(source, context);
 
     it('xss', () => {
       assert.deepStrictEqual(inspect(parser('[]{javascript:alert}')), [['<a class="invalid">javascript:alert</a>'], '']);
@@ -89,10 +90,28 @@ describe('Unit: parser/inline/link', () => {
       assert.deepStrictEqual(inspect(parser('[]{\\b}')), [[`<a href="\\b">\\b</a>`], '']);
       assert.deepStrictEqual(inspect(parser('[]{?b=c+d&\\#}')), [['<a href="?b=c+d&amp;\\#">?b=c+d&amp;\\#</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{?&amp;}')), [['<a href="?&amp;amp;">?&amp;amp;</a>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{./b}')), [['<a href="./b">./b</a>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{^/b}')), [[`<a href="/b">^/b</a>`], '']);
       assert.deepStrictEqual(inspect(parser('[]{#}')), [['<a href="#">#</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{#b}')), [['<a href="#b">#b</a>'], '']);
+      assert.deepStrictEqual(inspect(parser('[]{./b}')), [['<a href="./b">./b</a>'], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b}')), [[`<a href="/b">^/b</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b/.}')), [[`<a class="invalid">^/b/.</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b/./}')), [[`<a class="invalid">^/b/./</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b/..}')), [[`<a class="invalid">^/b/..</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b/../}')), [[`<a class="invalid">^/b/../</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b/../..}')), [[`<a class="invalid">^/b/../..</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b/../c}')), [[`<a class="invalid">^/b/../c</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b/../c/..}')), [[`<a class="invalid">^/b/../c/..</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b?/../}')), [[`<a href="/b?/../">^/b?/../</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b#/../}')), [[`<a href="/b#/../">^/b#/../</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b}', { host: new URL('/dir', location.origin) })), [[`<a href="/dir/b">^/b</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b}', { host: new URL('/dir/', location.origin) })), [[`<a href="/dir/b">^/b</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b}', { host: new URL('/folder/doc.md', location.origin) })), [[`<a href="/folder/b">^/b</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b}', { host: new URL('/folder/doc.md/', location.origin) })), [[`<a href="/folder/doc.md/b">^/b</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b}', { host: new URL('/.file', location.origin) })), [[`<a href="/b">^/b</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b}', { host: new URL('/0.0a', location.origin) })), [[`<a href="/b">^/b</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b}', { host: new URL('/0.a0', location.origin) })), [[`<a href="/b">^/b</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b}', { host: new URL('/0.0', location.origin) })), [[`<a href="/0.0/b">^/b</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/b}', { host: new URL('/0.0,0.0,0z', location.origin) })), [[`<a href="/0.0,0.0,0z/b">^/b</a>`], '']);
       assert.deepStrictEqual(inspect(parser('[ a]{b}')), [['<a href="b">a</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[ a ]{b}')), [['<a href="b">a</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[a ]{b}')), [['<a href="b">a</a>'], '']);

package/src/parser/inline/link.ts

@@ -7,7 +7,7 @@ import { inline, media, shortmedia } from '../inline';
 import { attributes } from './html';
 import { autolink } from '../autolink';
 import { str } from '../source';
-import { startLoose, visible, trimNode, stringify } from '../util';
+import { startLoose, trimNode, stringify } from '../util';
 import { html, define, defrag } from 'typed-dom';
 import { ReadonlyURL } from 'spica/url';
 
@@ -28,7 +28,7 @@ export const link: LinkParser = lazy(() => creator(10, bind(reverse(
       surround('[', shortmedia, ']'),
       surround(
         '[',
-        startLoose(visible(
+        startLoose(
         context({ syntax: { inline: {
           annotation: false,
           reference: false,
@@ -39,7 +39,7 @@ export const link: LinkParser = lazy(() => creator(10, bind(reverse(
           media: false,
           autolink: false,
         }}},
-        some(inline, ']', /^\\?\n/)))),
+        some(inline, ']', /^\\?\n/)), ']'),
         ']',
         true),
     ]))),
@@ -56,7 +56,7 @@ export const link: LinkParser = lazy(() => creator(10, bind(reverse(
       INSECURE_URI,
       trimNode(defrag(content)),
       new ReadonlyURL(
-        resolve(INSECURE_URI, context.host || location, context.url || location),
+        resolve(INSECURE_URI, context.host ?? location, context.url ?? context.host ?? location),
         context.host?.href || location.href),
       context.host?.origin || location.origin);
     if (el.classList.contains('invalid')) return [[el], rest];
@@ -81,33 +81,25 @@ export function resolve(uri: string, host: URL | Location, source: URL | Locatio
   assert(uri === uri.trim());
   switch (true) {
     case uri.slice(0, 2) === '^/':
-      const file = host.pathname.slice(host.pathname.lastIndexOf('/') + 1);
-      return file.includes('.')
-        ? `${host.pathname.slice(0, -file.length)}${uri.slice(2)}`
-        : `${fillTrailingSlash(host.pathname)}${uri.slice(2)}`;
+      const last = host.pathname.slice(host.pathname.lastIndexOf('/') + 1);
+      return last.includes('.') // isFile
+          && /^[0-9]*[a-z][0-9a-z]*$/i.test(last.slice(last.lastIndexOf('.') + 1))
+        ? `${host.pathname.slice(0, -last.length)}${uri.slice(2)}`
+        : `${host.pathname.replace(/\/?$/, '/')}${uri.slice(2)}`;
     case host.origin === source.origin
       && host.pathname === source.pathname:
     case uri.slice(0, 2) === '//':
       return uri;
     default:
       const target = new ReadonlyURL(uri, source.href);
-      return target.origin === uri.match(/^[A-Za-z][0-9A-Za-z.+-]*:\/\/[^/?#]*/)?.[0]
-        ? uri
-        : target.origin === host.origin
+      return target.origin === host.origin
           ? target.href.slice(target.origin.length)
           : target.href;
   }
 }
 
-function fillTrailingSlash(pathname: string): string {
-  assert(pathname);
-  return pathname[pathname.length - 1] === '/'
-    ? pathname
-    : pathname + '/';
-}
-
 function create(
-  address: string,
+  INSECURE_URI: string,
   content: readonly (string | HTMLElement)[],
   uri: ReadonlyURL,
   origin: string,
@@ -118,6 +110,12 @@ function create(
     case 'http:':
     case 'https:':
       assert(uri.host);
+      if (INSECURE_URI.slice(0, 2) === '^/' &&
+          /(?:\/\.\.?)(?:\/|$)/.test(INSECURE_URI.slice(0, INSECURE_URI.search(/[?#]|$/)))) {
+        type = 'argument';
+        description = 'Subresource paths cannot contain dot-segments.';
+        break;
+      }
       return html('a',
         {
           href: uri.source,
@@ -128,19 +126,19 @@ function create(
               : undefined,
         },
         content.length === 0
-          ? decode(address)
+          ? decode(INSECURE_URI)
           : content);
     case 'tel:':
       if (content.length === 0) {
-        content = [address];
+        content = [INSECURE_URI];
       }
       const pattern = /^(?:tel:)?(?:\+(?!0))?\d+(?:-\d+)*$/i;
       switch (true) {
         case content.length === 1
           && typeof content[0] === 'string'
-          && pattern.test(address)
+          && pattern.test(INSECURE_URI)
           && pattern.test(content[0])
-          && address.replace(/[^+\d]/g, '') === content[0].replace(/[^+\d]/g, ''):
+          && INSECURE_URI.replace(/[^+\d]/g, '') === content[0].replace(/[^+\d]/g, ''):
           return html('a', { href: uri.source }, content);
       }
       type = 'content';
@@ -155,7 +153,7 @@ function create(
       'data-invalid-description': description ??= 'Invalid protocol.',
     },
     content.length === 0
-      ? address
+      ? INSECURE_URI
       : content);
 }
 

package/src/parser/inline/media.test.ts

@@ -47,6 +47,8 @@ describe('Unit: parser/inline/media', () => {
       assert.deepStrictEqual(inspect(parser('![]{tel:1234567890}')), [['<img class="media invalid" data-src="tel:1234567890" alt="">'], '']);
       //assert.deepStrictEqual(inspect(parser('![]{http://[::ffff:0:0%1]}')), [['<img class="media invalid" alt="">'], '']);
       //assert.deepStrictEqual(inspect(parser('![]{http://[::ffff:0:0/96]}')), [['<img class="media invalid" alt="">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{./a}')), [['<img class="media invalid" data-src="./a" alt="">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{../a}')), [['<img class="media invalid" data-src="../a" alt="">'], '']);
       assert.deepStrictEqual(inspect(parser(' ![]{a}')), undefined);
       assert.deepStrictEqual(inspect(parser('[]{/}')), undefined);
     });
@@ -60,7 +62,6 @@ describe('Unit: parser/inline/media', () => {
       assert.deepStrictEqual(inspect(parser('![]{\\}')), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt=""></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![]{\\ }')), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt=""></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![]{\\b}')), [['<a href="\\b" target="_blank"><img class="media" data-src="\\b" alt=""></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{./b}')), [['<a href="./b" target="_blank"><img class="media" data-src="./b" alt=""></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![]{^/b}')), [[`<a href="/b" target="_blank"><img class="media" data-src="/b" alt=""></a>`], '']);
       assert.deepStrictEqual(inspect(parser('![ a]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![ a ]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);

package/src/parser/inline/media.ts

@@ -33,18 +33,19 @@ export const media: MediaParser = lazy(() => creator(10, bind(verify(fmap(open(
     assert(INSECURE_URI === INSECURE_URI.trim());
     assert(!INSECURE_URI.match(/\s/));
     const url = new ReadonlyURL(
-      resolve(INSECURE_URI, context.host || location, context.url || location),
+      resolve(INSECURE_URI, context.host ?? location, context.url ?? context.host ?? location),
       context.host?.href || location.href);
-    const cache = context.caches?.media;
-    const cached = cache?.has(url.href);
-    const el = cache && cached
-      ? cache.get(url.href)!.cloneNode(true)
-      : html('img', { class: 'media', 'data-src': url.source, alt: text });
-    if (!cached && !sanitize(url, el)) return [[el], rest];
-    cached && el.hasAttribute('alt') && el.setAttribute('alt', text);
+    let cache: HTMLElement | undefined;
+    const el = undefined
+      || (cache = context.caches?.media?.get(url.href)?.cloneNode(true))
+      || html('img', { class: 'media', 'data-src': url.source, alt: text });
+    assert(!el.matches('.invalid'));
+    if (!cache && !sanitize(url, el)) return [[el], rest];
+    assert(!el.matches('.invalid'));
+    cache?.hasAttribute('alt') && cache?.setAttribute('alt', text);
     define(el, attributes('media', push([], el.classList), optspec, params));
     assert(el.matches('img') || !el.matches('.invalid'));
-    if (context.syntax?.inline?.link === false || cached && el.tagName !== 'IMG') return [[el], rest];
+    if (context.syntax?.inline?.link === false || cache && cache.tagName !== 'IMG') return [[el], rest];
     return fmap(
       link as MediaParser,
       ([link]) => [define(link, { target: '_blank' }, [el])])
@@ -66,18 +67,29 @@ const option: MediaParser.ParameterParser.OptionParser = union([
 
 function sanitize(uri: ReadonlyURL, target: HTMLElement): boolean {
   assert(target.tagName === 'IMG');
+  assert(!target.matches('.invalid'));
+  if (/^\.\.?\//.test(uri.source)) {
+    define(target, {
+      class: void target.classList.add('invalid'),
+      'data-invalid-syntax': 'media',
+      'data-invalid-type': 'argument',
+      'data-invalid-description': 'Relative paths cannot be used with media syntax; Use subresource paths instead.',
+    });
+    return false;
+  }
   switch (uri.protocol) {
     case 'http:':
     case 'https:':
       assert(uri.host);
-      return true;
+      break;
+    default:
+      define(target, {
+        class: void target.classList.add('invalid'),
+        'data-invalid-syntax': 'media',
+        'data-invalid-type': 'argument',
+        'data-invalid-description': 'Invalid protocol.',
+      });
+      return false;
   }
-  assert(!target.classList.contains('invalid'));
-  define(target, {
-    class: void target.classList.add('invalid'),
-    'data-invalid-syntax': 'media',
-    'data-invalid-type': 'argument',
-    'data-invalid-description': 'Invalid protocol.',
-  });
-  return false;
+  return true;
 }

package/src/parser/inline/reference.ts

@@ -3,13 +3,13 @@ import { ReferenceParser } from '../inline';
 import { union, subsequence, some, validate, verify, focus, guard, context, creator, surround, lazy, fmap } from '../../combinator';
 import { inline } from '../inline';
 import { str } from '../source';
-import { startLoose, isStartTight, visible, trimNode, stringify } from '../util';
+import { startLoose, isStartLoose, trimNode, stringify } from '../util';
 import { html, defrag } from 'typed-dom';
 
 export const reference: ReferenceParser = lazy(() => creator(validate('[[', ']]', '\n', fmap(surround(
   '[[',
   guard(context => context.syntax?.inline?.reference ?? true,
-  startLoose(visible(
+  startLoose(
   context({ syntax: { inline: {
     annotation: false,
     reference: false,
@@ -24,15 +24,15 @@ export const reference: ReferenceParser = lazy(() => creator(validate('[[', ']]'
     abbr,
     focus('^', c => [['', c], '']),
     some(inline, ']', /^\\?\n/),
-  ]))))),
+  ])), ']]')),
   ']]'),
   ns => [html('sup', attributes(ns), trimNode(defrag(ns)))]))));
 
 const abbr: ReferenceParser.AbbrParser = creator(fmap(verify(surround(
   '^',
   union([str(/^(?![0-9]+\s?[|\]])[0-9A-Za-z]+(?:(?:-|(?=\W)(?!'\d)'?(?!\.\d)\.?(?!,\S),? ?)[0-9A-Za-z]+)*(?:-|'?\.?,? ?)?/)]),
-  /^\|?(?=]])|^\|[^\S\n]+/),
-  (_, rest, context) => isStartTight(rest, context)),
+  /^\|?(?=]])|^\|[^\S\n]/),
+  (_, rest, context) => isStartLoose(rest, context)),
   ([source]) => [html('abbr', source)]));
 
 function attributes(ns: (string | HTMLElement)[]): Record<string, string | undefined> {

package/src/parser/util.ts

@@ -70,16 +70,18 @@ function hasVisible(
   return false;
 }
 
-export function startLoose<P extends Parser<HTMLElement | string>>(parser: P): P;
-export function startLoose<T extends HTMLElement | string>(parser: Parser<T>): Parser<T> {
+export function startLoose<P extends Parser<HTMLElement | string>>(parser: P, except?: string): P;
+export function startLoose<T extends HTMLElement | string>(parser: Parser<T>, except?: string): Parser<T> {
   return (source, context) =>
-    isStartLoose(source, context)
+    isStartLoose(source, context, except)
       ? parser(source, context)
       : undefined;
 }
-function isStartLoose(source: string, context: MarkdownParser.Context): boolean {
+export function isStartLoose(source: string, context: MarkdownParser.Context, except?: string): boolean {
+  source &&= source.replace(/^[^\S\n]+/, '');
   if (source === '') return true;
-  return isStartTight(source.replace(/^[^\S\n]+/, ''), context);
+  return source.slice(0, except?.length ?? 0) !== except
+      && isStartTight(source, context);
 }
 export function startTight<P extends Parser<unknown>>(parser: P): P;
 export function startTight<T>(parser: Parser<T>): Parser<T> {
@@ -88,7 +90,7 @@ export function startTight<T>(parser: Parser<T>): Parser<T> {
       ? parser(source, context)
       : undefined;
 }
-export function isStartTight(source: string, context: MarkdownParser.Context): boolean {
+function isStartTight(source: string, context: MarkdownParser.Context): boolean {
   if (source === '') return true;
   switch (source[0]) {
     case ' ':
@@ -140,16 +142,6 @@ export function isEndTightNodes(nodes: readonly (HTMLElement | string)[]): boole
     : isVisible(nodes[last], -1) || last === 0 ||
       isVisible(nodes[last - 1], -1);
 }
-export function visible<P extends Parser<HTMLElement | string>>(parser: P): P;
-export function visible<T extends HTMLElement | string>(parser: Parser<T>): Parser<T> {
-  return verify(parser, nodes => {
-    if (nodes.length === 0) return true;
-    for (let i = 0; i < nodes.length; ++i) {
-      if (isVisible(nodes[i])) return true;
-    }
-    return false;
-  });
-}
 function isVisible(node: HTMLElement | string, position?: number): boolean {
   if (!node) return false;
   switch (typeof node) {

package/src/renderer/render.ts

@@ -12,7 +12,6 @@ const extend = reduce((opts: RenderingOptions): RenderingOptions =>
 
 export function render(source: HTMLElement, opts: RenderingOptions = {}): void {
   opts = extend(opts);
-  if (source.classList.contains('invalid')) return;
   const base = location.href;
   if (source.matches(selector)) return void render_(base, source, opts);
   for (
@@ -23,7 +22,7 @@ export function render(source: HTMLElement, opts: RenderingOptions = {}): void {
 }
 
 function render_(base: string, source: HTMLElement, opts: RenderingOptions): void {
-  assert(!source.matches('.invalid'));
+  if (source.classList.contains('invalid')) return;
   try {
     switch (true) {
       case !!opts.code