securemark 0.226.1 → 0.226.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.226.2
+
+- Refactoring.
+
 ## 0.226.1
 
 - Refactoring.

package/design.md

@@ -148,6 +148,14 @@
 ゆえに参照箇所に実体を記述する注釈構文および識別に文字列を使用する図表構文を採用し、その表示方法は任意とする。
 脚注構文は附番が手作業となり参照と実体の対応の管理が困難であるため不採用とし注釈構文により生成可能とする。
 
+### 羅列的知識への非依存
+
+構文はその使用のために羅列的知識を求めてはならない。
+
+ゆえにバックスラッシュエスケープの特殊処理の対象は改行文字のみに限られる。
+またURL構文はHTMLエンティティの参照の有効性を検査しない。
+HTMLEntity構文はエンティティ追加時の互換性確保のため不正なエンティティを検出する。
+
 ### テンプレート対応
 
 ソーステキストは自身をテンプレートとして別のソーステキストを生成するための構文を使用できなければならない。

package/dist/securemark.js

@@ -1,4 +1,4 @@
-/*! securemark v0.226.1 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED */
+/*! securemark v0.226.2 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED */
 require = function () {
     function r(e, n, t) {
         function o(i, f) {
@@ -4760,7 +4760,7 @@ require = function () {
                 'InvisibleComma',
                 'ic'
             ];
-            const unreadableEscapableCharacters = unreadableHTMLEntityNames.flatMap(name => (0, parser_1.eval)((0, htmlentity_1.htmlentity)(`&${ name };`, {}), []));
+            const unreadableEscapableCharacters = unreadableHTMLEntityNames.flatMap(name => (0, parser_1.eval)((0, htmlentity_1.unsafehtmlentity)(`&${ name };`, {}), []));
             const unreadableEscapableCharacter = new RegExp(`[${ [...new Set(unreadableEscapableCharacters)].join('') }]`, 'g');
             const unreadableSpecialCharacters = [
                 '\u2006',
@@ -5038,8 +5038,8 @@ require = function () {
                             class: 'invalid',
                             translate: 'no',
                             'data-invalid-syntax': 'codeblock',
-                            'data-invalid-type': closer ? 'argument' : 'closer',
-                            'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${ delim }.`
+                            'data-invalid-type': !closer ? 'closer' : 'argument',
+                            'data-invalid-description': !closer ? `Missing the closing delimiter ${ delim }.` : 'Invalid argument.'
                         }, `${ opener }${ body }${ closer }`)];
                 const file = (_a = path.split('/').pop()) !== null && _a !== void 0 ? _a : '';
                 const ext = file && file.includes('.', 1) ? file.split('.').pop() : '';
@@ -5176,8 +5176,8 @@ require = function () {
                             class: 'invalid',
                             translate: 'no',
                             'data-invalid-syntax': 'aside',
-                            'data-invalid-type': closer ? 'argument' : 'closer',
-                            'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${ delim }.`
+                            'data-invalid-type': !closer ? 'closer' : 'argument',
+                            'data-invalid-description': !closer ? `Missing the closing delimiter ${ delim }.` : 'Invalid argument.'
                         }, `${ opener }${ body }${ closer }`)];
                 const annotations = (0, typed_dom_1.html)('ol', { class: 'annotations' });
                 const references = (0, typed_dom_1.html)('ol', { class: 'references' });
@@ -5231,8 +5231,8 @@ require = function () {
                             class: 'invalid',
                             translate: 'no',
                             'data-invalid-syntax': 'example',
-                            'data-invalid-type': closer ? 'argument' : 'closer',
-                            'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${ delim }.`
+                            'data-invalid-type': !closer ? 'closer' : 'argument',
+                            'data-invalid-description': !closer ? `Missing the closing delimiter ${ delim }.` : 'Invalid argument.'
                         }, `${ opener }${ body }${ closer }`)];
                 switch (type) {
                 case 'markdown': {
@@ -5488,8 +5488,8 @@ require = function () {
                             class: 'invalid',
                             translate: 'no',
                             'data-invalid-syntax': 'message',
-                            'data-invalid-type': closer ? 'argument' : 'closer',
-                            'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${ delim }.`
+                            'data-invalid-type': !closer ? 'closer' : 'argument',
+                            'data-invalid-description': !closer ? `Missing the closing delimiter ${ delim }.` : 'Invalid argument.'
                         }, `${ opener }${ body }${ closer }`)];
                 switch (type) {
                 case 'note':
@@ -5559,8 +5559,8 @@ require = function () {
                     class: 'invalid',
                     translate: 'no',
                     'data-invalid-syntax': 'extension',
-                    'data-invalid-type': closer ? 'syntax' : 'closer',
-                    'data-invalid-description': closer ? 'Invalid syntax.' : `Missing the closing delimiter ${ delim }.`
+                    'data-invalid-type': !closer ? 'closer' : 'syntax',
+                    'data-invalid-description': !closer ? `Missing the closing delimiter ${ delim }.` : 'Invalid syntax.'
                 }, `${ opener }${ body }${ closer }`)])));
         },
         {
@@ -5593,8 +5593,8 @@ require = function () {
                                 class: 'invalid',
                                 translate: 'no',
                                 'data-invalid-syntax': 'table',
-                                'data-invalid-type': closer ? 'argument' : 'closer',
-                                'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${ delim }.`
+                                'data-invalid-type': !closer ? 'closer' : 'argument',
+                                'data-invalid-description': !closer ? `Missing the closing delimiter ${ delim }.` : 'Invalid argument.'
                             }, `${ opener }${ body }${ closer }`)],
                         ''
                     ];
@@ -5957,7 +5957,7 @@ require = function () {
             const global_1 = _dereq_('spica/global');
             const combinator_1 = _dereq_('../../combinator');
             const typed_dom_1 = _dereq_('typed-dom');
-            const opener = /^(\$\$)(?!\$)([^\n]*)(?:$|\n)/;
+            const opener = /^(\${2,})(?!\$)([^\n]*)(?:$|\n)/;
             exports.segment = (0, combinator_1.block)((0, combinator_1.validate)('$$', (0, combinator_1.clear)((0, combinator_1.fence)(opener, 100))));
             exports.segment_ = (0, combinator_1.block)((0, combinator_1.validate)('$$', (0, combinator_1.clear)((0, combinator_1.fence)(opener, 100, false))), false);
             exports.mathblock = (0, combinator_1.block)((0, combinator_1.validate)('$$', (0, combinator_1.fmap)((0, combinator_1.fence)(opener, 100), ([body, closer, opener, delim, param], _, {
@@ -5966,15 +5966,15 @@ require = function () {
                 } = {}
             }) => {
                 var _a;
-                return [closer && param.trimStart() === '' ? ((_a = cache === null || cache === void 0 ? void 0 : cache.get(`$$\n${ body }$$`)) === null || _a === void 0 ? void 0 : _a.cloneNode(true)) || (0, typed_dom_1.html)('div', {
+                return [delim.length === 2 && closer && param.trimStart() === '' ? ((_a = cache === null || cache === void 0 ? void 0 : cache.get(`\n${ body }`)) === null || _a === void 0 ? void 0 : _a.cloneNode(true)) || (0, typed_dom_1.html)('div', {
                         class: 'math',
                         translate: 'no'
-                    }, `$$\n${ body }$$`) : (0, typed_dom_1.html)('pre', {
+                    }, `${ delim }\n${ body }${ delim }`) : (0, typed_dom_1.html)('pre', {
                         class: 'invalid',
                         translate: 'no',
                         'data-invalid-syntax': 'mathblock',
-                        'data-invalid-type': closer ? 'argument' : 'closer',
-                        'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${ delim }.`
+                        'data-invalid-type': delim.length > 2 ? 'syntax' : !closer ? 'closer' : 'argument',
+                        'data-invalid-description': delim.length > 2 ? 'Invalid syntax' : !closer ? `Missing the closing delimiter ${ delim }.` : 'Invalid argument.'
                     }, `${ opener }${ body }${ closer }`)];
             })));
         },
@@ -6844,13 +6844,7 @@ require = function () {
                 /[0-9]{1,4}|[A-Za-z]/
             ].map(r => r.source).join('|') })`);
             const indexFW = new RegExp(index.source.replace(/[019AZaz](?!,)/g, c => String.fromCharCode(c.charCodeAt(0) + 65248)));
-            exports.bracket = (0, combinator_1.lazy)(() => (0, combinator_1.validate)([
-                '(',
-                '\uFF08',
-                '[',
-                '{',
-                '"'
-            ], (0, combinator_1.union)([
+            exports.bracket = (0, combinator_1.lazy)(() => (0, combinator_1.union)([
                 (0, combinator_1.surround)((0, source_1.str)('('), (0, source_1.str)(index), (0, source_1.str)(')'), false, ([as, bs = [], cs], rest) => [
                     (0, typed_dom_1.defrag)((0, array_1.push)((0, array_1.unshift)(as, bs), cs)),
                     rest
@@ -6885,7 +6879,7 @@ require = function () {
                     (0, array_1.unshift)(as, bs),
                     rest
                 ])
-            ])));
+            ]));
         },
         {
             '../../combinator': 30,
@@ -6903,7 +6897,7 @@ require = function () {
             exports.code = void 0;
             const combinator_1 = _dereq_('../../combinator');
             const typed_dom_1 = _dereq_('typed-dom');
-            exports.code = (0, combinator_1.creator)((0, combinator_1.validate)('`', '`', '\n', (0, combinator_1.match)(/^(`+)(?!`)([^\n]*?[^`\n])\1(?!`)/, ([whole, , body]) => rest => [
+            exports.code = (0, combinator_1.creator)((0, combinator_1.validate)('`', (0, combinator_1.match)(/^(`+)(?!`)([^\n]*?[^`\n])\1(?!`)/, ([whole, , body]) => rest => [
                 [(0, typed_dom_1.html)('code', { 'data-src': whole }, format(body))],
                 rest
             ])));
@@ -7301,14 +7295,14 @@ require = function () {
             exports.segment = (0, combinator_1.clear)((0, combinator_1.validate)([
                 '[$',
                 '$'
-            ], '-', '\n', (0, combinator_1.union)([
+            ], (0, combinator_1.union)([
                 (0, combinator_1.surround)('[', body, ']'),
                 body
             ])));
             exports.label = (0, combinator_1.creator)((0, combinator_1.validate)([
                 '[$',
                 '$'
-            ], '-', '\n', (0, combinator_1.fmap)((0, combinator_1.guard)(context => {
+            ], (0, combinator_1.fmap)((0, combinator_1.guard)(context => {
                 var _a, _b, _c;
                 return (_c = (_b = (_a = context.syntax) === null || _a === void 0 ? void 0 : _a.inline) === null || _b === void 0 ? void 0 : _b.label) !== null && _c !== void 0 ? _c : true;
             }, (0, combinator_1.union)([
@@ -7413,7 +7407,7 @@ require = function () {
             };
             (0, alias_1.ObjectSetPrototypeOf)(attrspec, null);
             (0, alias_1.ObjectValues)(attrspec).forEach(o => (0, alias_1.ObjectSetPrototypeOf)(o, null));
-            exports.html = (0, combinator_1.lazy)(() => (0, combinator_1.creator)((0, combinator_1.validate)('<', '>', '\n', (0, combinator_1.validate)(/^<[a-z]+(?=[^\S\n]|>)/, (0, combinator_1.union)([
+            exports.html = (0, combinator_1.lazy)(() => (0, combinator_1.creator)((0, combinator_1.validate)('<', (0, combinator_1.validate)(/^<[a-z]+(?=[^\S\n]|>)/, (0, combinator_1.union)([
                 (0, combinator_1.match)(/^(?=<(wbr)(?=[^\S\n]|>))/, (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.surround)((0, source_1.str)(`<${ tag }`), (0, combinator_1.some)((0, combinator_1.union)([exports.attribute])), (0, source_1.str)('>'), true, ([, as = []], rest) => [
                     [(0, typed_dom_1.html)(tag, attributes('html', [], attrspec[tag], as))],
                     rest
@@ -7535,14 +7529,26 @@ require = function () {
         function (_dereq_, module, exports) {
             'use strict';
             Object.defineProperty(exports, '__esModule', { value: true });
-            exports.htmlentity = void 0;
+            exports.htmlentity = exports.unsafehtmlentity = void 0;
             const combinator_1 = _dereq_('../../combinator');
             const typed_dom_1 = _dereq_('typed-dom');
             const parser = (0, typed_dom_1.html)('textarea');
-            exports.htmlentity = (0, combinator_1.creator)((0, combinator_1.validate)('&', ';', '\n', (0, combinator_1.focus)(/^&[0-9A-Za-z]+;/, entity => [
+            exports.unsafehtmlentity = (0, combinator_1.creator)((0, combinator_1.validate)('&', (0, combinator_1.verify)((0, combinator_1.focus)(/^&[0-9A-Za-z]+;/, entity => [
                 [(parser.innerHTML = entity, parser.value)],
                 ''
-            ])));
+            ]), ([str]) => str[0] !== '&' || str.length < 3)));
+            exports.htmlentity = (0, combinator_1.creator)((0, combinator_1.validate)('&', (0, combinator_1.focus)(/^&[0-9A-Za-z]+;/, (0, combinator_1.union)([
+                exports.unsafehtmlentity,
+                str => [
+                    [(0, typed_dom_1.html)('span', {
+                            class: 'invalid',
+                            'data-invalid-syntax': 'htmlentity',
+                            'data-invalid-type': 'syntax',
+                            'data-invalid-description': 'Invalid HTML entity.'
+                        }, str)],
+                    ''
+                ]
+            ]))));
         },
         {
             '../../combinator': 30,
@@ -7762,7 +7768,7 @@ require = function () {
             const util_1 = _dereq_('../util');
             const typed_dom_1 = _dereq_('typed-dom');
             const disallowedCommand = /\\(?:begin|tiny|huge|large)(?![0-9a-z])/i;
-            exports.math = (0, combinator_1.lazy)(() => (0, combinator_1.creator)((0, combinator_1.validate)('$', '$', '\n', (0, combinator_1.rewrite)((0, combinator_1.union)([
+            exports.math = (0, combinator_1.lazy)(() => (0, combinator_1.creator)((0, combinator_1.validate)('$', (0, combinator_1.rewrite)((0, combinator_1.union)([
                 (0, combinator_1.surround)('$', (0, combinator_1.verify)((0, source_1.str)(/^(?![\s{}#$%&]|\d+(?:[,.]\d+)*[^-+*/=<>^_~\\$]|-[\da-z]|[a-z]+-)(?:\\\$|[\x20-\x23\x25-\x7E])+/i), util_1.isEndTightNodes), /^\$(?![0-9a-z])/i),
                 (0, combinator_1.surround)('$', bracket, '$')
             ]), (source, {
@@ -7826,7 +7832,7 @@ require = function () {
                 return (_c = (_b = (_a = context.syntax) === null || _a === void 0 ? void 0 : _a.inline) === null || _b === void 0 ? void 0 : _b.media) !== null && _c !== void 0 ? _c : true;
             }, (0, combinator_1.tails)([
                 (0, combinator_1.dup)((0, combinator_1.surround)(/^\[(?!\s*\\\s)/, (0, combinator_1.some)((0, combinator_1.union)([
-                    htmlentity_1.htmlentity,
+                    htmlentity_1.unsafehtmlentity,
                     bracket,
                     source_1.txt
                 ]), ']', /^\\?\n/), ']', true)),
@@ -7866,7 +7872,7 @@ require = function () {
             })));
             const bracket = (0, combinator_1.lazy)(() => (0, combinator_1.union)([
                 (0, combinator_1.surround)((0, source_1.str)('('), (0, combinator_1.some)((0, combinator_1.union)([
-                    htmlentity_1.htmlentity,
+                    htmlentity_1.unsafehtmlentity,
                     bracket,
                     source_1.txt
                 ]), ')'), (0, source_1.str)(')'), true, global_1.undefined, ([as, bs = []], rest) => [
@@ -7874,7 +7880,7 @@ require = function () {
                     rest
                 ]),
                 (0, combinator_1.surround)((0, source_1.str)('['), (0, combinator_1.some)((0, combinator_1.union)([
-                    htmlentity_1.htmlentity,
+                    htmlentity_1.unsafehtmlentity,
                     bracket,
                     source_1.txt
                 ]), ']'), (0, source_1.str)(']'), true, global_1.undefined, ([as, bs = []], rest) => [
@@ -7882,7 +7888,7 @@ require = function () {
                     rest
                 ]),
                 (0, combinator_1.surround)((0, source_1.str)('{'), (0, combinator_1.some)((0, combinator_1.union)([
-                    htmlentity_1.htmlentity,
+                    htmlentity_1.unsafehtmlentity,
                     bracket,
                     source_1.txt
                 ]), '}'), (0, source_1.str)('}'), true, global_1.undefined, ([as, bs = []], rest) => [
@@ -7890,7 +7896,7 @@ require = function () {
                     rest
                 ]),
                 (0, combinator_1.surround)((0, source_1.str)('"'), (0, combinator_1.some)((0, combinator_1.union)([
-                    htmlentity_1.htmlentity,
+                    htmlentity_1.unsafehtmlentity,
                     source_1.txt
                 ]), '"'), (0, source_1.str)('"'), true)
             ]));
@@ -8052,10 +8058,12 @@ require = function () {
                 while (source !== '') {
                     switch (source[0]) {
                     case '&': {
-                            const result = (0, htmlentity_1.htmlentity)(source, context);
-                            acc[acc.length - 1] += (0, parser_1.eval)(result, [source[0]])[0];
-                            source = (0, parser_1.exec)(result, source.slice(1));
-                            continue;
+                            const result = (0, htmlentity_1.unsafehtmlentity)(source, context);
+                            if (result) {
+                                acc[acc.length - 1] += (0, parser_1.eval)(result, [source[0]])[0];
+                                source = (0, parser_1.exec)(result, source.slice(1));
+                                continue;
+                            }
                         }
                     default: {
                             if (source[0].trimStart() === '') {
@@ -8417,6 +8425,7 @@ require = function () {
                     const buffer = new multimap_1.MultiMap();
                     const titles = new global_1.Map();
                     const check = footnotes.some(el => target.contains(el));
+                    let style;
                     for (let refs = target.querySelectorAll(`sup.${ syntax }:not(.disabled)`), i = 0, len = refs.length; i < len; ++i) {
                         yield;
                         const ref = refs[i];
@@ -8425,6 +8434,15 @@ require = function () {
                         const identifier = identify(ref);
                         const abbr = ref.getAttribute('data-abbr') || global_1.undefined;
                         const content = contentify(ref);
+                        style !== null && style !== void 0 ? style : style = abbr ? 'abbr' : 'count';
+                        if (style === 'count' ? abbr : !abbr) {
+                            (0, typed_dom_1.define)(ref, {
+                                class: `${ ref.className } invalid`,
+                                'data-invalid-syntax': syntax,
+                                'data-invalid-type': 'style',
+                                'data-invalid-description': `${ syntax[0].toUpperCase() + syntax.slice(1) } style must be consistent.`
+                            });
+                        }
                         if (((_a = ref.firstElementChild) === null || _a === void 0 ? void 0 : _a.getAttribute('hidden')) !== '') {
                             ref.replaceChildren((0, typed_dom_1.html)('span', { hidden: '' }, ref.childNodes));
                         } else {
@@ -8442,6 +8460,8 @@ require = function () {
                         if (title && !blank && def.childNodes.length === 1) {
                             def.insertBefore(content.cloneNode(true), def.lastChild);
                             for (const ref of buffer.take(identifier, global_1.Infinity)) {
+                                if (ref.getAttribute('data-invalid-type') !== 'content')
+                                    continue;
                                 (0, typed_dom_1.define)(ref, {
                                     title,
                                     class: void ref.classList.remove('invalid'),
@@ -8997,7 +9017,7 @@ require = function () {
                     return ((_a = source[1]) === null || _a === void 0 ? void 0 : _a.trimStart()) !== '';
                 case '&':
                     switch (true) {
-                    case source.length > 2 && source[1] !== ' ' && ((_b = (0, parser_1.eval)((0, htmlentity_1.htmlentity)(source, context))) === null || _b === void 0 ? void 0 : _b[0].trimStart()) === '':
+                    case source.length > 2 && source[1] !== ' ' && ((_b = (0, parser_1.eval)((0, htmlentity_1.unsafehtmlentity)(source, context))) === null || _b === void 0 ? void 0 : _b[0].trimStart()) === '':
                         return false;
                     }
                     return true;

package/markdown.d.ts

@@ -844,7 +844,7 @@ export namespace MarkdownParser {
       export interface TextParser extends
         Inline<'media/text'>,
         Parser<string[], Context, [
-          HTMLEntityParser,
+          UnsafeHTMLEntityParser,
           TextParser.BracketParser,
           SourceParser.TxtParser,
         ]> {
@@ -854,22 +854,22 @@ export namespace MarkdownParser {
           Inline<'media/text/bracket'>,
           Parser<string, Context, [
             Parser<string, Context, [
-              HTMLEntityParser,
+              UnsafeHTMLEntityParser,
               BracketParser,
               SourceParser.TxtParser,
             ]>,
             Parser<string, Context, [
-              HTMLEntityParser,
+              UnsafeHTMLEntityParser,
               BracketParser,
               SourceParser.TxtParser,
             ]>,
             Parser<string, Context, [
-              HTMLEntityParser,
+              UnsafeHTMLEntityParser,
               BracketParser,
               SourceParser.TxtParser,
             ]>,
             Parser<string, Context, [
-              HTMLEntityParser,
+              UnsafeHTMLEntityParser,
               SourceParser.TxtParser,
             ]>,
           ]> {
@@ -1003,6 +1003,14 @@ export namespace MarkdownParser {
     export interface HTMLEntityParser extends
       // &copy;
       Inline<'htmlentity'>,
+      Parser<HTMLSpanElement | string, Context, [
+        UnsafeHTMLEntityParser,
+        Parser<HTMLSpanElement, Context, []>,
+      ]> {
+    }
+    export interface UnsafeHTMLEntityParser extends
+      // &copy;
+      Inline<'unsafehtmlentity'>,
       Parser<string, Context, []> {
     }
     export interface ShortmediaParser extends

package/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.226.1",
+  "version": "0.226.2",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -548,9 +548,9 @@
       "dev": true
     },
     "@types/node": {
-      "version": "17.0.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-17.0.0.tgz",
-      "integrity": "sha512-eMhwJXc931Ihh4tkU+Y7GiLzT/y/DBNpNtr4yU9O2w3SYBsr9NaOPhQlLKRmoWtI54uNwuo0IOUFQjVOTZYRvw==",
+      "version": "17.0.4",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-17.0.4.tgz",
+      "integrity": "sha512-6xwbrW4JJiJLgF+zNypN5wr2ykM9/jHcL7rQ8fZe2vuftggjzZeRSM4OwRc6Xk8qWjwJ99qVHo/JgOGmomWRog==",
       "dev": true
     },
     "@types/power-assert": {
@@ -1790,9 +1790,9 @@
       "dev": true
     },
     "caniuse-lite": {
-      "version": "1.0.30001291",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001291.tgz",
-      "integrity": "sha512-roMV5V0HNGgJ88s42eE70sstqGW/gwFndosYrikHthw98N5tLnOTxFqMLQjZVRxTWFlJ4rn+MsgXrR7MDPY4jA==",
+      "version": "1.0.30001292",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001292.tgz",
+      "integrity": "sha512-jnT4Tq0Q4ma+6nncYQVe7d73kmDmE9C3OGTx3MvW7lBM/eY1S1DZTMBON7dqV481RhNiS5OxD7k9JQvmDOTirw==",
       "dev": true
     },
     "chalk": {
@@ -2867,9 +2867,9 @@
       "dev": true
     },
     "electron-to-chromium": {
-      "version": "1.4.24",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.24.tgz",
-      "integrity": "sha512-erwx5r69B/WFfFuF2jcNN0817BfDBdC4765kQ6WltOMuwsimlQo3JTEq0Cle+wpHralwdeX3OfAtw/mHxPK0Wg==",
+      "version": "1.4.28",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.28.tgz",
+      "integrity": "sha512-Gzbf0wUtKfyPaqf0Plz+Ctinf9eQIzxEqBHwSvbGfeOm9GMNdLxyu1dNiCUfM+x6r4BE0xUJNh3Nmg9gfAtTmg==",
       "dev": true
     },
     "elliptic": {
@@ -5929,9 +5929,9 @@
       }
     },
     "istanbul-reports": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.1.1.tgz",
-      "integrity": "sha512-q1kvhAXWSsXfMjCdNHNPKZZv94OlspKnoGv+R9RGbnqOOQ0VbNfLFgQDVgi7hHenKsndGq3/o0OBdzDXthWcNw==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.1.2.tgz",
+      "integrity": "sha512-0gHxuT1NNC0aEIL1zbJ+MTgPbbHhU77eJPuU35WKA7TgXiSNlCAx4PENoMrH0Or6M2H80TaZcWKhM0IK6V8gRw==",
       "dev": true,
       "requires": {
         "html-escaper": "^2.0.0",
@@ -6134,9 +6134,9 @@
       }
     },
     "karma-coverage-istanbul-instrumenter": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/karma-coverage-istanbul-instrumenter/-/karma-coverage-istanbul-instrumenter-1.0.3.tgz",
-      "integrity": "sha512-zyaPd28Bz5bRbtIbz3N+t8P/cfohmggrpM0PkkV5dYTSh7tYYZJIYx7WxpywgR9av6CbTeeZw/XS9tr9n+qLuA==",
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/karma-coverage-istanbul-instrumenter/-/karma-coverage-istanbul-instrumenter-1.0.4.tgz",
+      "integrity": "sha512-lde9WPGld1fuawEqoaibd+lq6wrs5HHwEnfzHUh5LlpU9TJqUCjhtHLFVUxJtGEhi/XUZJmlOKuk59NZJrKamg==",
       "dev": true,
       "requires": {
         "convert-source-map": "^1.7.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.226.1",
+  "version": "0.226.2",
   "description": "Secure markdown renderer working on browsers for user input data.",
   "private": false,
   "homepage": "https://github.com/falsandtru/securemark",

package/src/parser/api/normalize.ts

@@ -1,4 +1,4 @@
-import { htmlentity } from '../inline/htmlentity';
+import { unsafehtmlentity } from '../inline/htmlentity';
 import { eval } from '../../combinator/data/parser';
 
 const UNICODE_REPLACEMENT_CHARACTER = '\uFFFD';
@@ -59,7 +59,7 @@ const unreadableHTMLEntityNames = [
   'ic',
 ];
 const unreadableEscapableCharacters = unreadableHTMLEntityNames
-  .flatMap(name => eval(htmlentity(`&${name};`, {}), []));
+  .flatMap(name => eval(unsafehtmlentity(`&${name};`, {}), []));
 assert(unreadableEscapableCharacters.length === unreadableHTMLEntityNames.length);
 const unreadableEscapableCharacter = new RegExp(`[${
   [...new Set<string>(unreadableEscapableCharacters)].join('')

package/src/parser/block/codeblock.ts

@@ -29,8 +29,8 @@ export const codeblock: CodeBlockParser = block(validate('```', fmap(
       class: 'invalid',
       translate: 'no',
       'data-invalid-syntax': 'codeblock',
-      'data-invalid-type': closer ? 'argument' : 'closer',
-      'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${delim}.`,
+      'data-invalid-type': !closer ? 'closer' : 'argument',
+      'data-invalid-description': !closer ? `Missing the closing delimiter ${delim}.` : 'Invalid argument.',
     }, `${opener}${body}${closer}`)];
     const file = path.split('/').pop() ?? '';
     const ext = file && file.includes('.', 1)

package/src/parser/block/extension/aside.ts

@@ -12,8 +12,8 @@ export const aside: ExtensionParser.AsideParser = creator(100, block(validate('~
       class: 'invalid',
       translate: 'no',
       'data-invalid-syntax': 'aside',
-      'data-invalid-type': closer ? 'argument' : 'closer',
-      'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${delim}.`,
+      'data-invalid-type': !closer ? 'closer' : 'argument',
+      'data-invalid-description': !closer ? `Missing the closing delimiter ${delim}.` : 'Invalid argument.',
     }, `${opener}${body}${closer}`)];
     const annotations = html('ol', { class: 'annotations' });
     const references = html('ol', { class: 'references' });

package/src/parser/block/extension/example.ts

@@ -15,8 +15,8 @@ export const example: ExtensionParser.ExampleParser = creator(100, block(validat
       class: 'invalid',
       translate: 'no',
       'data-invalid-syntax': 'example',
-      'data-invalid-type': closer ? 'argument' : 'closer',
-      'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${delim}.`,
+      'data-invalid-type': !closer ? 'closer' : 'argument',
+      'data-invalid-description': !closer ? `Missing the closing delimiter ${delim}.` : 'Invalid argument.',
     }, `${opener}${body}${closer}`)];
     switch (type) {
       case 'markdown': {

package/src/parser/block/extension/message.ts

@@ -24,8 +24,8 @@ export const message: MessageParser = block(validate('~~~', fmap(
       class: 'invalid',
       translate: 'no',
       'data-invalid-syntax': 'message',
-      'data-invalid-type': closer ? 'argument' : 'closer',
-      'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${delim}.`,
+      'data-invalid-type': !closer ? 'closer' : 'argument',
+      'data-invalid-description': !closer ? `Missing the closing delimiter ${delim}.` : 'Invalid argument.',
     }, `${opener}${body}${closer}`)];
     switch (type) {
       case 'note':

package/src/parser/block/extension/placeholder.ts

@@ -17,7 +17,7 @@ export const placeholder: ExtensionParser.PlaceholderParser = block(validate('~~
       class: 'invalid',
       translate: 'no',
       'data-invalid-syntax': 'extension',
-      'data-invalid-type': closer ? 'syntax' : 'closer',
-      'data-invalid-description': closer ? 'Invalid syntax.' : `Missing the closing delimiter ${delim}.`,
+      'data-invalid-type': !closer ? 'closer' : 'syntax',
+      'data-invalid-description': !closer ? `Missing the closing delimiter ${delim}.` : 'Invalid syntax.',
     }, `${opener}${body}${closer}`)
   ])));

package/src/parser/block/extension/table.ts

@@ -31,8 +31,8 @@ export const table: TableParser = block(validate('~~~', recover(bind(
       class: 'invalid',
       translate: 'no',
       'data-invalid-syntax': 'table',
-      'data-invalid-type': closer ? 'argument' : 'closer',
-      'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${delim}.`,
+      'data-invalid-type': !closer ? 'closer' : 'argument',
+      'data-invalid-description': !closer ? `Missing the closing delimiter ${delim}.` : 'Invalid argument.',
     }, `${opener}${body}${closer}`)], ''];
     return parser(body, context) ?? [[html('table')], ''];
   }),

package/src/parser/block/mathblock.test.ts

@@ -17,9 +17,10 @@ describe('Unit: parser/block/mathblock', () => {
       assert.deepStrictEqual(inspect(parser('$$\na\n$$\nb')), [['<pre class="invalid" translate="no">$$\na\n$$\nb</pre>'], '']);
       assert.deepStrictEqual(inspect(parser('$$$\n\n\n$$$')), undefined);
       assert.deepStrictEqual(inspect(parser('$$ $$\n$$')), undefined);
-      assert.deepStrictEqual(inspect(parser('$$latex\n$$')), [['<pre class="invalid" translate="no">$$latex\n$$</pre>'], '']);
-      assert.deepStrictEqual(inspect(parser('$$$\n$$')), undefined);
-      assert.deepStrictEqual(inspect(parser('$$$\n$$$')), undefined);
+      assert.deepStrictEqual(inspect(parser('$$lang\n$$')), [['<pre class="invalid" translate="no">$$lang\n$$</pre>'], '']);
+      assert.deepStrictEqual(inspect(parser('$$ param\n$$')), [['<pre class="invalid" translate="no">$$ param\n$$</pre>'], '']);
+      assert.deepStrictEqual(inspect(parser('$$$\n$$')), [['<pre class="invalid" translate="no">$$$\n$$</pre>'], '']);
+      assert.deepStrictEqual(inspect(parser('$$$\n$$$')), [['<pre class="invalid" translate="no">$$$\n$$$</pre>'], '']);
       assert.deepStrictEqual(inspect(parser(' $$\n$$')), undefined);
       assert.deepStrictEqual(inspect(parser(`$$\n0${'\n'.repeat(101)}$$`), '>'), [['<pre class="invalid" translate="no">'], '']);
     });

package/src/parser/block/mathblock.ts

@@ -3,7 +3,7 @@ import { MathBlockParser } from '../block';
 import { block, validate, fence, clear, fmap } from '../../combinator';
 import { html } from 'typed-dom';
 
-const opener = /^(\$\$)(?!\$)([^\n]*)(?:$|\n)/;
+const opener = /^(\${2,})(?!\$)([^\n]*)(?:$|\n)/;
 
 export const segment: MathBlockParser.SegmentParser = block(validate('$$',
   clear(fence(opener, 100))));
@@ -15,14 +15,14 @@ export const mathblock: MathBlockParser = block(validate('$$', fmap(
   fence(opener, 100),
   // Bug: Type mismatch between outer and inner.
   ([body, closer, opener, delim, param]: string[], _, { caches: { math: cache = undefined } = {} }) => [
-    closer && param.trimStart() === ''
-      ? cache?.get(`$$\n${body}$$`)?.cloneNode(true) as HTMLDivElement ||
-        html('div', { class: 'math', translate: 'no' }, `$$\n${body}$$`)
+    delim.length === 2 && closer && param.trimStart() === ''
+      ? cache?.get(`\n${body}`)?.cloneNode(true) as HTMLDivElement ||
+        html('div', { class: 'math', translate: 'no' }, `${delim}\n${body}${delim}`)
       : html('pre', {
           class: 'invalid',
           translate: 'no',
           'data-invalid-syntax': 'mathblock',
-          'data-invalid-type': closer ? 'argument' : 'closer',
-          'data-invalid-description': closer ? 'Invalid argument.' : `Missing the closing delimiter ${delim}.`,
+          'data-invalid-type': delim.length > 2 ? 'syntax' : !closer ? 'closer' : 'argument',
+          'data-invalid-description': delim.length > 2 ? 'Invalid syntax' : !closer ? `Missing the closing delimiter ${delim}.` : 'Invalid argument.',
         }, `${opener}${body}${closer}`),
   ])));

package/src/parser/inline/bracket.ts

@@ -1,6 +1,6 @@
 import { undefined } from 'spica/global';
 import { BracketParser } from '../inline';
-import { union, some, validate, surround, lazy } from '../../combinator';
+import { union, some, surround, lazy } from '../../combinator';
 import { inline } from '../inline';
 import { str } from '../source';
 import { html, defrag } from 'typed-dom';
@@ -12,7 +12,7 @@ const index = new RegExp(`^(?:${[
 ].map(r => r.source).join('|')})`);
 const indexFW = new RegExp(index.source.replace(/[019AZaz](?!,)/g, c => String.fromCharCode(c.charCodeAt(0) + 0xfee0)));
 
-export const bracket: BracketParser = lazy(() => validate(['(', '（', '[', '{', '"'], union([
+export const bracket: BracketParser = lazy(() => union([
   surround(str('('), str(index), str(')'), false,
     ([as, bs = [], cs], rest) => [defrag(push(unshift(as, bs), cs)), rest]),
   surround(str('（'), str(indexFW), str('）'), false,
@@ -33,4 +33,4 @@ export const bracket: BracketParser = lazy(() => validate(['(', '（', '[', '{',
   surround(str('"'), some(inline, '"', '"'), str('"'), true,
     undefined,
     ([as, bs = []], rest) => [unshift(as, bs), rest]),
-])));
+]));

package/src/parser/inline/code.ts

@@ -2,7 +2,7 @@ import { CodeParser } from '../inline';
 import { validate, creator, match } from '../../combinator';
 import { html } from 'typed-dom';
 
-export const code: CodeParser = creator(validate('`', '`', '\n', match(
+export const code: CodeParser = creator(validate('`', match(
   /^(`+)(?!`)([^\n]*?[^`\n])\1(?!`)/,
   ([whole, , body]) => rest =>
     [[html('code', { 'data-src': whole }, format(body))], rest])));

package/src/parser/inline/extension/index.test.ts

@@ -75,7 +75,7 @@ describe('Unit: parser/inline/extension/index', () => {
       assert.deepStrictEqual(inspect(parser('[#a|#b c]')), [['<a class="index" href="#index:b_c">a<span class="indexer" data-index="b_c"></span></a>'], '']);
       assert.deepStrictEqual(inspect(parser('[#a|#b  c]')), [['<a class="index" href="#index:b_c">a<span class="indexer" data-index="b_c"></span></a>'], '']);
       assert.deepStrictEqual(inspect(parser('[#a|#[]]')), [['<a class="index" href="#index:[]">a<span class="indexer" data-index="[]"></span></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('[#a|#&amp;]')), [['<a class="index" href="#index:&amp;amp;">a<span class="indexer" data-index="&amp;amp;"></span></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('[#a|#&copy;]')), [['<a class="index" href="#index:&amp;copy;">a<span class="indexer" data-index="&amp;copy;"></span></a>'], '']);
       assert.deepStrictEqual(inspect(parser('[#a |]')), [['<a class="index" href="#index:a_|">a |</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[#a |#]')), [['<a class="index" href="#index:a_|#">a |#</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[#a |#b]')), [['<a class="index" href="#index:b">a<span class="indexer" data-index="b"></span></a>'], '']);

package/src/parser/inline/extension/label.ts

@@ -7,12 +7,12 @@ import { join } from 'spica/array';
 
 const body = str(/^\$[A-Za-z]*(?:(?:-[A-Za-z][0-9A-Za-z]*)+|-(?:(?:0|[1-9][0-9]*)\.)*(?:0|[1-9][0-9]*)(?![0-9A-Za-z]))/);
 
-export const segment: ExtensionParser.LabelParser.SegmentParser = clear(validate(['[$', '$'], '-', '\n', union([
+export const segment: ExtensionParser.LabelParser.SegmentParser = clear(validate(['[$', '$'], union([
   surround('[', body, ']'),
   body,
 ])));
 
-export const label: ExtensionParser.LabelParser = creator(validate(['[$', '$'], '-', '\n', fmap(
+export const label: ExtensionParser.LabelParser = creator(validate(['[$', '$'], fmap(
   guard(context => context.syntax?.inline?.label ?? true,
   union([
     surround('[', body, ']'),

package/src/parser/inline/html.ts

@@ -20,7 +20,7 @@ const attrspec = {
 ObjectSetPrototypeOf(attrspec, null);
 ObjectValues(attrspec).forEach(o => ObjectSetPrototypeOf(o, null));
 
-export const html: HTMLParser = lazy(() => creator(validate('<', '>', '\n', validate(/^<[a-z]+(?=[^\S\n]|>)/, union([
+export const html: HTMLParser = lazy(() => creator(validate('<', validate(/^<[a-z]+(?=[^\S\n]|>)/, union([
   match(
     /^(?=<(wbr)(?=[^\S\n]|>))/,
     memoize(

package/src/parser/inline/htmlentity.test.ts

@@ -13,6 +13,7 @@ describe('Unit: parser/inline/htmlentity', () => {
       assert.deepStrictEqual(inspect(parser('&;')), undefined);
       assert.deepStrictEqual(inspect(parser('& ;')), undefined);
       assert.deepStrictEqual(inspect(parser('&\n;')), undefined);
+      assert.deepStrictEqual(inspect(parser('&a;')), [['<span class="invalid">&amp;a;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('&#;')), undefined);
       assert.deepStrictEqual(inspect(parser('&#g;')), undefined);
       assert.deepStrictEqual(inspect(parser('&#x;')), undefined);

package/src/parser/inline/htmlentity.ts

@@ -1,9 +1,24 @@
-import { HTMLEntityParser } from '../inline';
-import { validate, focus, creator } from '../../combinator';
+import { HTMLEntityParser, UnsafeHTMLEntityParser } from '../inline';
+import { union, validate, verify, focus, creator } from '../../combinator';
 import { html } from 'typed-dom';
 
 const parser = html('textarea');
 
-export const htmlentity: HTMLEntityParser = creator(validate('&', ';', '\n', focus(
+export const unsafehtmlentity: UnsafeHTMLEntityParser = creator(validate('&', verify(focus(
   /^&[0-9A-Za-z]+;/,
-  entity => [[(parser.innerHTML = entity, parser.value)], ''])));
+  entity => [[(parser.innerHTML = entity, parser.value)], '']),
+  ([str]) => str[0] !== '&' || str.length < 3)));
+
+export const htmlentity: HTMLEntityParser = creator(validate('&', focus(
+  /^&[0-9A-Za-z]+;/,
+  union([
+    unsafehtmlentity,
+    str => [[
+      html('span', {
+        class: 'invalid',
+        'data-invalid-syntax': 'htmlentity',
+        'data-invalid-type': 'syntax',
+        'data-invalid-description': 'Invalid HTML entity.',
+      }, str),
+    ], '']
+  ]))));

package/src/parser/inline/link.test.ts

@@ -98,7 +98,7 @@ describe('Unit: parser/inline/link', () => {
       assert.deepStrictEqual(inspect(parser('[]{\\ }')), [[`<a href="\\">\\</a>`], '']);
       assert.deepStrictEqual(inspect(parser('[]{\\b}')), [[`<a href="\\b">\\b</a>`], '']);
       assert.deepStrictEqual(inspect(parser('[]{?b=c+d&\\#}')), [['<a href="?b=c+d&amp;\\#">?b=c+d&amp;\\#</a>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{?&amp;}')), [['<a href="?&amp;amp;">?&amp;amp;</a>'], '']);
+      assert.deepStrictEqual(inspect(parser('[]{?&copy;}')), [['<a href="?&amp;copy;">?&amp;copy;</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{#}')), [['<a href="#">#</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{#b}')), [['<a href="#b">#b</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{./b}')), [['<a href="./b">./b</a>'], '']);

package/src/parser/inline/math.ts

@@ -6,7 +6,7 @@ import { html } from 'typed-dom';
 
 const disallowedCommand = /\\(?:begin|tiny|huge|large)(?![0-9a-z])/i;
 
-export const math: MathParser = lazy(() => creator(validate('$', '$', '\n', rewrite(
+export const math: MathParser = lazy(() => creator(validate('$', rewrite(
   union([
     surround(
       '$',

package/src/parser/inline/media.ts

@@ -4,7 +4,7 @@ import { MediaParser } from '../inline';
 import { union, inits, tails, some, validate, verify, guard, creator, surround, open, dup, lazy, fmap, bind } from '../../combinator';
 import { link, uri, option as linkoption, resolve } from './link';
 import { attributes } from './html';
-import { htmlentity } from './htmlentity';
+import { unsafehtmlentity } from './htmlentity';
 import { txt, str } from '../source';
 import { html, define } from 'typed-dom';
 import { ReadonlyURL } from 'spica/url';
@@ -23,7 +23,7 @@ export const media: MediaParser = lazy(() => creator(10, bind(verify(fmap(open(
   validate(['[', '{'], '}', '\n',
   guard(context => context.syntax?.inline?.media ?? true,
   tails([
-    dup(surround(/^\[(?!\s*\\\s)/, some(union([htmlentity, bracket, txt]), ']', /^\\?\n/), ']', true)),
+    dup(surround(/^\[(?!\s*\\\s)/, some(union([unsafehtmlentity, bracket, txt]), ']', /^\\?\n/), ']', true)),
     dup(surround(/^{(?![{}])/, inits([uri, some(option)]), /^[^\S\n]?}/)),
   ])))),
   ([as, bs]) => bs ? [[join(as).trim() || join(as)], bs] : [[''], as]),
@@ -53,10 +53,10 @@ export const media: MediaParser = lazy(() => creator(10, bind(verify(fmap(open(
   })));
 
 const bracket: MediaParser.TextParser.BracketParser = lazy(() => union([
-  surround(str('('), some(union([htmlentity, bracket, txt]), ')'), str(')'), true, undefined, ([as, bs = []], rest) => [unshift(as, bs), rest]),
-  surround(str('['), some(union([htmlentity, bracket, txt]), ']'), str(']'), true, undefined, ([as, bs = []], rest) => [unshift(as, bs), rest]),
-  surround(str('{'), some(union([htmlentity, bracket, txt]), '}'), str('}'), true, undefined, ([as, bs = []], rest) => [unshift(as, bs), rest]),
-  surround(str('"'), some(union([htmlentity, txt]), '"'), str('"'), true),
+  surround(str('('), some(union([unsafehtmlentity, bracket, txt]), ')'), str(')'), true, undefined, ([as, bs = []], rest) => [unshift(as, bs), rest]),
+  surround(str('['), some(union([unsafehtmlentity, bracket, txt]), ']'), str(']'), true, undefined, ([as, bs = []], rest) => [unshift(as, bs), rest]),
+  surround(str('{'), some(union([unsafehtmlentity, bracket, txt]), '}'), str('}'), true, undefined, ([as, bs = []], rest) => [unshift(as, bs), rest]),
+  surround(str('"'), some(union([unsafehtmlentity, txt]), '"'), str('"'), true),
 ]));
 
 const option: MediaParser.ParameterParser.OptionParser = union([

package/src/parser/inline/ruby.ts

@@ -2,7 +2,7 @@ import { undefined } from 'spica/global';
 import { RubyParser } from '../inline';
 import { eval, exec } from '../../combinator/data/parser';
 import { sequence, validate, verify, focus, creator, surround, lazy, bind } from '../../combinator';
-import { htmlentity } from './htmlentity';
+import { unsafehtmlentity } from './htmlentity';
 import { text as txt } from '../source';
 import { isStartTightNodes } from '../util';
 import { html, defrag } from 'typed-dom';
@@ -51,11 +51,15 @@ const text: RubyParser.TextParser = creator((source, context) => {
   while (source !== '') {
     assert(source[0] !== '\n');
     switch (source[0]) {
+      // @ts-expect-error
       case '&': {
-        const result = htmlentity(source, context);
-        acc[acc.length - 1] += eval(result, [source[0]])[0];
-        source = exec(result, source.slice(1));
-        continue;
+        const result = unsafehtmlentity(source, context);
+        if (result) {
+          acc[acc.length - 1] += eval(result, [source[0]])[0];
+          source = exec(result, source.slice(1));
+          continue;
+        }
+        // fallthrough
       }
       default: {
         if (source[0].trimStart() === '') {

package/src/parser/inline.ts

@@ -44,6 +44,7 @@ export import CodeParser = InlineParser.CodeParser;
 export import MathParser = InlineParser.MathParser;
 export import MediaParser = InlineParser.MediaParser;
 export import HTMLEntityParser = InlineParser.HTMLEntityParser;
+export import UnsafeHTMLEntityParser = InlineParser.UnsafeHTMLEntityParser;
 export import ShortmediaParser = InlineParser.ShortmediaParser;
 export import AutolinkParser = InlineParser.AutolinkParser;
 export import BracketParser = InlineParser.BracketParser;

package/src/parser/processor/footnote.ts

@@ -40,6 +40,7 @@ function build(
     const buffer = new MultiMap<string, HTMLElement>();
     const titles = new Map<string, string>();
     const check = footnotes.some(el => target.contains(el));
+    let style: 'count' | 'abbr';
     for (
       let refs = target.querySelectorAll<HTMLElement>(`sup.${syntax}:not(.disabled)`),
           i = 0, len = refs.length; i < len; ++i) {
@@ -49,6 +50,15 @@ function build(
       const identifier = identify(ref);
       const abbr = ref.getAttribute('data-abbr') || undefined;
       const content = contentify(ref);
+      style ??= abbr ? 'abbr' : 'count';
+      if (style === 'count' ? abbr : !abbr) {
+        define(ref, {
+          class: `${ref.className} invalid`,
+          'data-invalid-syntax': syntax,
+          'data-invalid-type': 'style',
+          'data-invalid-description': `${syntax[0].toUpperCase() + syntax.slice(1)} style must be consistent.`,
+        });
+      }
       if (ref.firstElementChild?.getAttribute('hidden') !== '') {
         ref.replaceChildren(html('span', { hidden: '' }, ref.childNodes));
       }
@@ -79,6 +89,7 @@ function build(
         def.insertBefore(content.cloneNode(true), def.lastChild);
         assert(def.childNodes.length > 1);
         for (const ref of buffer.take(identifier, Infinity)) {
+          if (ref.getAttribute('data-invalid-type') !== 'content') continue;
           define(ref, {
             title,
             class: void ref.classList.remove('invalid'),

package/src/parser/source/text.ts

@@ -46,6 +46,7 @@ export const text: TextParser = creator((source, context) => {
         case '？': {
           const i = source.slice(1).search(nonWhitespace) + 1;
           if (i > 0 && source.slice(i, i + 2) === '\\\n') return [[source[0], html('span', { class: 'linebreak' })], source.slice(i + 2)];
+          // fallthrough
         }
         default:
           assert(source[0] !== '\n');

package/src/parser/util.ts

@@ -3,7 +3,7 @@ import { MarkdownParser } from '../../markdown';
 import { Parser, eval } from '../combinator/data/parser';
 import { union, some, verify, clear, convert, trim } from '../combinator';
 import { comment } from './inline/comment';
-import { htmlentity } from './inline/htmlentity';
+import { unsafehtmlentity } from './inline/htmlentity';
 import { linebreak, unescsource, str } from './source';
 import { push, pop } from 'spica/array';
 
@@ -104,7 +104,7 @@ function isStartTight(source: string, context: MarkdownParser.Context): boolean
       switch (true) {
         case source.length > 2
           && source[1] !== ' '
-          && eval(htmlentity(source, context))?.[0].trimStart() === '':
+          && eval(unsafehtmlentity(source, context))?.[0].trimStart() === '':
           return false;
       }
       return true;