securemark 0.226.3 → 0.226.4

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.226.4
+
+- Refactoring.
+
 ## 0.226.3
 
 - Refactoring.

package/dist/securemark.js

@@ -1,4 +1,4 @@
-/*! securemark v0.226.3 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED */
+/*! securemark v0.226.4 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED */
 require = function () {
     function r(e, n, t) {
         function o(i, f) {
@@ -4715,8 +4715,9 @@ require = function () {
             'use strict';
             Object.defineProperty(exports, '__esModule', { value: true });
             exports.escape = exports.normalize = void 0;
-            const htmlentity_1 = _dereq_('../inline/htmlentity');
             const parser_1 = _dereq_('../../combinator/data/parser');
+            const htmlentity_1 = _dereq_('../inline/htmlentity');
+            const util_1 = _dereq_('../util');
             const UNICODE_REPLACEMENT_CHARACTER = '\uFFFD';
             function normalize(source) {
                 return sanitize(format(source));
@@ -4760,7 +4761,7 @@ require = function () {
                 'InvisibleComma',
                 'ic'
             ];
-            const unreadableEscapableCharacters = unreadableHTMLEntityNames.flatMap(name => (0, parser_1.eval)((0, htmlentity_1.unsafehtmlentity)(`&${ name };`, {}), []));
+            const unreadableEscapableCharacters = unreadableHTMLEntityNames.map(name => (0, util_1.stringify)((0, parser_1.eval)((0, htmlentity_1.htmlentity)(`&${ name };`, {}))));
             const unreadableEscapableCharacter = new RegExp(`[${ [...new Set(unreadableEscapableCharacters)].join('') }]`, 'g');
             const unreadableSpecialCharacters = [
                 '\u2006',
@@ -4785,7 +4786,8 @@ require = function () {
         },
         {
             '../../combinator/data/parser': 50,
-            '../inline/htmlentity': 115
+            '../inline/htmlentity': 115,
+            '../util': 137
         }
     ],
     64: [
@@ -6916,35 +6918,51 @@ require = function () {
             Object.defineProperty(exports, '__esModule', { value: true });
             exports.comment = void 0;
             const combinator_1 = _dereq_('../../combinator');
+            const parser_1 = _dereq_('../../combinator/data/parser');
+            const htmlentity_1 = _dereq_('./htmlentity');
+            const source_1 = _dereq_('../source');
             const typed_dom_1 = _dereq_('typed-dom');
-            const memoize_1 = _dereq_('spica/memoize');
-            const closer = (0, memoize_1.memoize)(sharps => new RegExp(String.raw`\s${ sharps }]`));
-            exports.comment = (0, combinator_1.creator)((0, combinator_1.validate)('[#', (0, combinator_1.match)(/^\[(#+)\s+(?!\s|\1\])(?:(\S[^\n]*?(?:\n.*?){0,99}?(?:\s|\n\s*))\1\])?/, ([, sharps, title]) => (rest, {resources}) => {
-                if (title)
+            exports.comment = (0, combinator_1.creator)((0, combinator_1.validate)('[#', (0, combinator_1.match)(/^\[(#+)\s+(?!\s|\1\])((?:\S+\s+)+?)(\1\]|(?=\[\1\s))/, ([whole, , body, closer]) => (rest, context) => {
+                [whole, body] = `${ whole }\0${ body.trimEnd() }`.replace(/\x7F.?/gs, '').split('\0', 2);
+                if (!closer)
                     return [
                         [(0, typed_dom_1.html)('sup', {
-                                class: 'comment',
-                                title: title.trimEnd().replace(/\x7F.?/gs, '')
-                            })],
+                                class: 'comment invalid',
+                                'data-invalid-syntax': 'comment',
+                                'data-invalid-type': 'content',
+                                'data-invalid-description': 'Comment syntax using the same level cannot start in another comment syntax.'
+                            }, whole)],
                         rest
                     ];
-                const i = rest.search(closer(sharps));
-                if (i !== -1)
+                const title = (0, parser_1.eval)((0, combinator_1.some)(text)(body, context), []).join('').trim();
+                if (title.includes('\0'))
                     return [
                         [(0, typed_dom_1.html)('sup', {
                                 class: 'comment invalid',
                                 'data-invalid-syntax': 'comment',
                                 'data-invalid-type': 'content',
-                                'data-invalid-description': 'Too many lines.'
-                            }, rest.slice(0, i).trimEnd().replace(/\x7F.?/gs, ''))],
-                        rest.slice(i + sharps.length + 2)
+                                'data-invalid-description': `Invalid HTML entitiy "${ title.match(/\0&[0-9A-Za-z]+;/)[0].slice(1) }".`
+                            }, whole)],
+                        rest
                     ];
-                resources && (resources.budget -= 10);
+                return [
+                    [(0, typed_dom_1.html)('sup', {
+                            class: 'comment',
+                            title
+                        })],
+                    rest
+                ];
             })));
+            const text = (0, combinator_1.union)([
+                htmlentity_1.unsafehtmlentity,
+                source_1.unescsource
+            ]);
         },
         {
             '../../combinator': 30,
-            'spica/memoize': 20,
+            '../../combinator/data/parser': 50,
+            '../source': 131,
+            './htmlentity': 115,
             'typed-dom': 29
         }
     ],
@@ -7533,22 +7551,16 @@ require = function () {
             const combinator_1 = _dereq_('../../combinator');
             const typed_dom_1 = _dereq_('typed-dom');
             const parser = (0, typed_dom_1.html)('textarea');
-            exports.unsafehtmlentity = (0, combinator_1.creator)((0, combinator_1.validate)('&', (0, combinator_1.verify)((0, combinator_1.focus)(/^&[0-9A-Za-z]+;/, entity => [
+            exports.unsafehtmlentity = (0, combinator_1.creator)((0, combinator_1.validate)('&', (0, combinator_1.fmap)((0, combinator_1.focus)(/^&[0-9A-Za-z]+;/, entity => [
                 [(parser.innerHTML = entity, parser.value)],
                 ''
-            ]), ([str]) => str[0] !== '&' || str.length < 3)));
-            exports.htmlentity = (0, combinator_1.creator)((0, combinator_1.validate)('&', (0, combinator_1.focus)(/^&[0-9A-Za-z]+;/, (0, combinator_1.union)([
-                exports.unsafehtmlentity,
-                str => [
-                    [(0, typed_dom_1.html)('span', {
-                            class: 'invalid',
-                            'data-invalid-syntax': 'htmlentity',
-                            'data-invalid-type': 'syntax',
-                            'data-invalid-description': 'Invalid HTML entity.'
-                        }, str)],
-                    ''
-                ]
-            ]))));
+            ]), ([str]) => [str[0] !== '&' || str.length < 3 ? str : `\0${ str }`])));
+            exports.htmlentity = (0, combinator_1.creator)((0, combinator_1.validate)('&', (0, combinator_1.fmap)((0, combinator_1.union)([exports.unsafehtmlentity]), ([str]) => [str[0] === '\0' ? (0, typed_dom_1.html)('span', {
+                    class: 'invalid',
+                    'data-invalid-syntax': 'htmlentity',
+                    'data-invalid-type': 'syntax',
+                    'data-invalid-description': 'Invalid HTML entity.'
+                }, str.slice(1)) : str])));
         },
         {
             '../../combinator': 30,
@@ -7629,11 +7641,11 @@ require = function () {
                     (0, combinator_1.some)(exports.option)
                 ]), /^[^\S\n]?}/))
             ])))), ([params, content = []], rest, context) => {
-                var _a, _b, _c, _d, _e;
-                if ((0, parser_1.eval)((0, combinator_1.some)(autolink_1.autolink)((0, util_1.stringify)(content), context), []).some(node => typeof node === 'object'))
+                var _a, _b, _c, _d, _e, _f;
+                if ((_a = (0, parser_1.eval)((0, combinator_1.some)(autolink_1.autolink)((0, util_1.stringify)(content), context))) === null || _a === void 0 ? void 0 : _a.some(node => typeof node === 'object'))
                     return;
                 const INSECURE_URI = params.shift();
-                const el = create(INSECURE_URI, (0, util_1.trimNode)((0, typed_dom_1.defrag)(content)), new url_1.ReadonlyURL(resolve(INSECURE_URI, (_a = context.host) !== null && _a !== void 0 ? _a : global_1.location, (_c = (_b = context.url) !== null && _b !== void 0 ? _b : context.host) !== null && _c !== void 0 ? _c : global_1.location), ((_d = context.host) === null || _d === void 0 ? void 0 : _d.href) || global_1.location.href), ((_e = context.host) === null || _e === void 0 ? void 0 : _e.origin) || global_1.location.origin);
+                const el = create(INSECURE_URI, (0, util_1.trimNode)((0, typed_dom_1.defrag)(content)), new url_1.ReadonlyURL(resolve(INSECURE_URI, (_b = context.host) !== null && _b !== void 0 ? _b : global_1.location, (_d = (_c = context.url) !== null && _c !== void 0 ? _c : context.host) !== null && _d !== void 0 ? _d : global_1.location), ((_e = context.host) === null || _e === void 0 ? void 0 : _e.href) || global_1.location.href), ((_f = context.host) === null || _f === void 0 ? void 0 : _f.origin) || global_1.location.origin);
                 if (el.classList.contains('invalid'))
                     return [
                         [el],
@@ -7704,7 +7716,7 @@ require = function () {
                 }, content.length === 0 ? INSECURE_URI : content);
             }
             function decode(uri) {
-                if (uri.indexOf('%') === -1)
+                if (!uri.includes('%'))
                     return uri;
                 try {
                     uri = (0, global_1.decodeURI)(uri);
@@ -7856,12 +7868,12 @@ require = function () {
                     'data-src': url.source,
                     alt: text
                 });
-                if (!cache && !sanitize(url, el))
+                (cache === null || cache === void 0 ? void 0 : cache.hasAttribute('alt')) && (cache === null || cache === void 0 ? void 0 : cache.setAttribute('alt', text));
+                if (!sanitize(el, url, text))
                     return [
                         [el],
                         rest
                     ];
-                (cache === null || cache === void 0 ? void 0 : cache.hasAttribute('alt')) && (cache === null || cache === void 0 ? void 0 : cache.setAttribute('alt', text));
                 (0, typed_dom_1.define)(el, (0, html_1.attributes)('media', (0, array_1.push)([], el.classList), optspec, params));
                 if (((_j = (_h = context.syntax) === null || _h === void 0 ? void 0 : _h.inline) === null || _j === void 0 ? void 0 : _j.link) === false || cache && cache.tagName !== 'IMG')
                     return [
@@ -7908,7 +7920,21 @@ require = function () {
                 (0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[1-9][0-9]*:[1-9][0-9]*(?=[^\S\n]|})/), ([opt]) => [` aspect-ratio="${ opt.slice(1).split(':').join('/') }"`]),
                 link_1.option
             ]);
-            function sanitize(uri, target) {
+            function sanitize(target, uri, alt) {
+                var _a;
+                switch (uri.protocol) {
+                case 'http:':
+                case 'https:':
+                    break;
+                default:
+                    (0, typed_dom_1.define)(target, {
+                        class: void target.classList.add('invalid'),
+                        'data-invalid-syntax': 'media',
+                        'data-invalid-type': 'argument',
+                        'data-invalid-description': 'Invalid protocol.'
+                    });
+                    return false;
+                }
                 if (/\/\.\.?(?:\/|$)/.test('/' + uri.source.slice(0, uri.source.search(/[?#]|$/)))) {
                     (0, typed_dom_1.define)(target, {
                         class: void target.classList.add('invalid'),
@@ -7918,16 +7944,13 @@ require = function () {
                     });
                     return false;
                 }
-                switch (uri.protocol) {
-                case 'http:':
-                case 'https:':
-                    break;
-                default:
+                if (alt.includes('\0')) {
                     (0, typed_dom_1.define)(target, {
                         class: void target.classList.add('invalid'),
                         'data-invalid-syntax': 'media',
-                        'data-invalid-type': 'argument',
-                        'data-invalid-description': 'Invalid protocol.'
+                        'data-invalid-type': 'content',
+                        'data-invalid-description': `Cannot use invalid HTML entitiy "${ alt.match(/&[0-9A-Za-z]+;/)[0] }".`,
+                        alt: (_a = target.getAttribute('alt')) === null || _a === void 0 ? void 0 : _a.replace(/\0/g, '')
                     });
                     return false;
                 }
@@ -8025,7 +8048,7 @@ require = function () {
                 switch (true) {
                 case rubies.length <= texts.length:
                     return [
-                        [(0, typed_dom_1.html)('ruby', (0, typed_dom_1.defrag)((0, array_1.push)(texts.reduce((acc, _, i) => (0, array_1.push)(acc, (0, array_1.unshift)([texts[i]], i < rubies.length && rubies[i] ? [
+                        [(0, typed_dom_1.html)('ruby', attributes(texts, rubies), (0, typed_dom_1.defrag)((0, array_1.push)(texts.reduce((acc, _, i) => (0, array_1.push)(acc, (0, array_1.unshift)([texts[i]], i < rubies.length && rubies[i] ? [
                                 (0, typed_dom_1.html)('rp', '('),
                                 (0, typed_dom_1.html)('rt', rubies[i]),
                                 (0, typed_dom_1.html)('rp', ')')
@@ -8034,7 +8057,7 @@ require = function () {
                     ];
                 case texts.length === 1 && [...texts[0]].length >= rubies.length:
                     return [
-                        [(0, typed_dom_1.html)('ruby', (0, typed_dom_1.defrag)((0, array_1.push)([...texts[0]].reduce((acc, _, i, texts) => (0, array_1.push)(acc, (0, array_1.unshift)([texts[i]], i < rubies.length && rubies[i] ? [
+                        [(0, typed_dom_1.html)('ruby', attributes(texts, rubies), (0, typed_dom_1.defrag)((0, array_1.push)([...texts[0]].reduce((acc, _, i, texts) => (0, array_1.push)(acc, (0, array_1.unshift)([texts[i]], i < rubies.length && rubies[i] ? [
                                 (0, typed_dom_1.html)('rp', '('),
                                 (0, typed_dom_1.html)('rt', rubies[i]),
                                 (0, typed_dom_1.html)('rp', ')')
@@ -8043,7 +8066,7 @@ require = function () {
                     ];
                 default:
                     return [
-                        [(0, typed_dom_1.html)('ruby', (0, typed_dom_1.defrag)((0, array_1.push)((0, array_1.unshift)([(0, array_1.join)(texts, ' ')], [
+                        [(0, typed_dom_1.html)('ruby', attributes(texts, rubies), (0, typed_dom_1.defrag)((0, array_1.push)((0, array_1.unshift)([(0, array_1.join)(texts, ' ')], [
                                 (0, typed_dom_1.html)('rp', '('),
                                 (0, typed_dom_1.html)('rt', (0, array_1.join)(rubies, ' ').trim()),
                                 (0, typed_dom_1.html)('rp', ')')
@@ -8060,7 +8083,7 @@ require = function () {
                     case '&': {
                             const result = (0, htmlentity_1.unsafehtmlentity)(source, context);
                             if (result) {
-                                acc[acc.length - 1] += (0, parser_1.eval)(result, [source[0]])[0];
+                                acc[acc.length - 1] += (0, parser_1.eval)(result)[0];
                                 source = (0, parser_1.exec)(result, source.slice(1));
                                 continue;
                             }
@@ -8083,6 +8106,26 @@ require = function () {
                     ''
                 ] : global_1.undefined;
             });
+            function attributes(texts, rubies) {
+                let attrs;
+                for (const ss of [
+                        texts,
+                        rubies
+                    ]) {
+                    for (let i = 0; i < ss.length; ++i) {
+                        if (!ss[i].includes('\0'))
+                            continue;
+                        ss[i] = ss[i].replace(/\0/g, '');
+                        attrs !== null && attrs !== void 0 ? attrs : attrs = {
+                            class: 'invalid',
+                            'data-invalid-syntax': 'ruby',
+                            'data-invalid-type': ss === texts ? 'content' : 'argument',
+                            'data-invalid-description': 'Invalid HTML entity.'
+                        };
+                    }
+                }
+                return attrs !== null && attrs !== void 0 ? attrs : {};
+            }
         },
         {
             '../../combinator': 30,
@@ -8962,7 +9005,7 @@ require = function () {
                 'InvisibleComma',
                 'ic'
             ];
-            const blankline = new RegExp(String.raw`^(?!$|\n)(?:\\?\s|&(?:${ invisibleHTMLEntityNames.join('|') });|<wbr>|\[(#+)\s+(?!\s|\1\])\S[^\n]*?(?:\n.*?){0,99}?(?:\s|\n\s*)\1\])*\\?(?:$|\n)`, 'gm');
+            const blankline = new RegExp(String.raw`^(?!$|\n)(?:\\?\s|&(?:${ invisibleHTMLEntityNames.join('|') });|<wbr>|\[(#+)\s+(?!\s|\1\])(?:\S+\s+)+?(?:\1\]|(?=\[\1\s)))*\\?(?:$|\n)`, 'gm');
             function visualize(parser) {
                 return (0, combinator_1.convert)(source => source.replace(blankline, line => line.replace(/[\\&<\[]/g, '\x7F\\$&')), (0, combinator_1.union)([
                     (0, combinator_1.verify)(parser, (ns, rest, context) => !rest && hasVisible(ns, context)),
@@ -9012,7 +9055,7 @@ require = function () {
             }
             exports.startTight = startTight;
             function isStartTight(source, context) {
-                var _a, _b, _c, _d;
+                var _a, _b, _c, _d, _e;
                 if (source === '')
                     return true;
                 switch (source[0]) {
@@ -9025,7 +9068,7 @@ require = function () {
                     return ((_a = source[1]) === null || _a === void 0 ? void 0 : _a.trimStart()) !== '';
                 case '&':
                     switch (true) {
-                    case source.length > 2 && source[1] !== ' ' && ((_b = (0, parser_1.eval)((0, htmlentity_1.unsafehtmlentity)(source, context))) === null || _b === void 0 ? void 0 : _b[0].trimStart()) === '':
+                    case source.length > 2 && source[1] !== ' ' && ((_c = (_b = (0, parser_1.eval)((0, htmlentity_1.unsafehtmlentity)(source, context))) === null || _b === void 0 ? void 0 : _b[0]) === null || _c === void 0 ? void 0 : _c.trimStart()) === '':
                         return false;
                     }
                     return true;
@@ -9037,7 +9080,7 @@ require = function () {
                     return true;
                 case '[':
                     switch (true) {
-                    case source.length >= 7 && source[1] === '#' && ((_c = (0, parser_1.eval)((0, comment_1.comment)(source, context))) === null || _c === void 0 ? void 0 : _c[0].className) === 'comment':
+                    case source.length >= 7 && source[1] === '#' && ((_d = (0, parser_1.eval)((0, comment_1.comment)(source, context))) === null || _d === void 0 ? void 0 : _d[0].className) === 'comment':
                         return false;
                     }
                     return true;

package/markdown.d.ts

@@ -928,7 +928,18 @@ export namespace MarkdownParser {
     export interface CommentParser extends
       // [# comment #]
       Inline<'comment'>,
-      Parser<HTMLElement, Context, []> {
+      Parser<HTMLElement, Context, [
+        CommentParser.TextParser,
+      ]> {
+    }
+    export namespace CommentParser {
+      export interface TextParser extends
+        Inline<'comment/text'>,
+        Parser<string, Context, [
+          UnsafeHTMLEntityParser,
+          SourceParser.UnescapableSourceParser,
+        ]> {
+      }
     }
     export interface InsertionParser extends
       // ++abc++
@@ -1005,7 +1016,6 @@ export namespace MarkdownParser {
       Inline<'htmlentity'>,
       Parser<HTMLSpanElement | string, Context, [
         UnsafeHTMLEntityParser,
-        Parser<HTMLSpanElement, Context, []>,
       ]> {
     }
     export interface UnsafeHTMLEntityParser extends

package/package-lock.json

@@ -1,16 +1,16 @@
 {
   "name": "securemark",
-  "version": "0.226.3",
+  "version": "0.226.4",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
     "@babel/code-frame": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.16.0.tgz",
-      "integrity": "sha512-IF4EOMEV+bfYwOmNxGzSnjR2EmQod7f1UXOpZM3l4i4o4QNwzjtJAu/HxdjHq0aYBvdqMuQEY1eg0nqW9ZPORA==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.16.7.tgz",
+      "integrity": "sha512-iAXqUn8IIeBTNd72xsFlgaXHkMBMt6y4HJp1tIaK465CWLT/fG1aqB7ykr95gHHmlBdGbFeWWfyB4NJJ0nmeIg==",
       "dev": true,
       "requires": {
-        "@babel/highlight": "^7.16.0"
+        "@babel/highlight": "^7.16.7"
       }
     },
     "@babel/compat-data": {
@@ -20,20 +20,20 @@
       "dev": true
     },
     "@babel/core": {
-      "version": "7.16.5",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.16.5.tgz",
-      "integrity": "sha512-wUcenlLzuWMZ9Zt8S0KmFwGlH6QKRh3vsm/dhDA3CHkiTA45YuG1XkHRcNRl73EFPXDp/d5kVOU0/y7x2w6OaQ==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.16.0",
-        "@babel/generator": "^7.16.5",
-        "@babel/helper-compilation-targets": "^7.16.3",
-        "@babel/helper-module-transforms": "^7.16.5",
-        "@babel/helpers": "^7.16.5",
-        "@babel/parser": "^7.16.5",
-        "@babel/template": "^7.16.0",
-        "@babel/traverse": "^7.16.5",
-        "@babel/types": "^7.16.0",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.16.7.tgz",
+      "integrity": "sha512-aeLaqcqThRNZYmbMqtulsetOQZ/5gbR/dWruUCJcpas4Qoyy+QeagfDsPdMrqwsPRDNxJvBlRiZxxX7THO7qtA==",
+      "dev": true,
+      "requires": {
+        "@babel/code-frame": "^7.16.7",
+        "@babel/generator": "^7.16.7",
+        "@babel/helper-compilation-targets": "^7.16.7",
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helpers": "^7.16.7",
+        "@babel/parser": "^7.16.7",
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.7",
+        "@babel/types": "^7.16.7",
         "convert-source-map": "^1.7.0",
         "debug": "^4.1.0",
         "gensync": "^1.0.0-beta.2",
@@ -81,24 +81,24 @@
       }
     },
     "@babel/generator": {
-      "version": "7.16.5",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.16.5.tgz",
-      "integrity": "sha512-kIvCdjZqcdKqoDbVVdt5R99icaRtrtYhYK/xux5qiWCBmfdvEYMFZ68QCrpE5cbFM1JsuArUNs1ZkuKtTtUcZA==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.16.7.tgz",
+      "integrity": "sha512-/ST3Sg8MLGY5HVYmrjOgL60ENux/HfO/CsUh7y4MalThufhE/Ff/6EibFDHi4jiDCaWfJKoqbE6oTh21c5hrRg==",
       "dev": true,
       "requires": {
-        "@babel/types": "^7.16.0",
+        "@babel/types": "^7.16.7",
         "jsesc": "^2.5.1",
         "source-map": "^0.5.0"
       }
     },
     "@babel/helper-compilation-targets": {
-      "version": "7.16.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.16.3.tgz",
-      "integrity": "sha512-vKsoSQAyBmxS35JUOOt+07cLc6Nk/2ljLIHwmq2/NM6hdioUaqEXq/S+nXvbvXbZkNDlWOymPanJGOc4CBjSJA==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.16.7.tgz",
+      "integrity": "sha512-mGojBwIWcwGD6rfqgRXVlVYmPAv7eOpIemUG3dGnDdCY4Pae70ROij3XmfrH6Fa1h1aiDylpglbZyktfzyo/hA==",
       "dev": true,
       "requires": {
-        "@babel/compat-data": "^7.16.0",
-        "@babel/helper-validator-option": "^7.14.5",
+        "@babel/compat-data": "^7.16.4",
+        "@babel/helper-validator-option": "^7.16.7",
         "browserslist": "^4.17.5",
         "semver": "^6.3.0"
       },
@@ -112,116 +112,116 @@
       }
     },
     "@babel/helper-environment-visitor": {
-      "version": "7.16.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.16.5.tgz",
-      "integrity": "sha512-ODQyc5AnxmZWm/R2W7fzhamOk1ey8gSguo5SGvF0zcB3uUzRpTRmM/jmLSm9bDMyPlvbyJ+PwPEK0BWIoZ9wjg==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.16.7.tgz",
+      "integrity": "sha512-SLLb0AAn6PkUeAfKJCCOl9e1R53pQlGAfc4y4XuMRZfqeMYLE0dM1LMhqbGAlGQY0lfw5/ohoYWAe9V1yibRag==",
       "dev": true,
       "requires": {
-        "@babel/types": "^7.16.0"
+        "@babel/types": "^7.16.7"
       }
     },
     "@babel/helper-function-name": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.16.0.tgz",
-      "integrity": "sha512-BZh4mEk1xi2h4HFjWUXRQX5AEx4rvaZxHgax9gcjdLWdkjsY7MKt5p0otjsg5noXw+pB+clMCjw+aEVYADMjog==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.16.7.tgz",
+      "integrity": "sha512-QfDfEnIUyyBSR3HtrtGECuZ6DAyCkYFp7GHl75vFtTnn6pjKeK0T1DB5lLkFvBea8MdaiUABx3osbgLyInoejA==",
       "dev": true,
       "requires": {
-        "@babel/helper-get-function-arity": "^7.16.0",
-        "@babel/template": "^7.16.0",
-        "@babel/types": "^7.16.0"
+        "@babel/helper-get-function-arity": "^7.16.7",
+        "@babel/template": "^7.16.7",
+        "@babel/types": "^7.16.7"
       }
     },
     "@babel/helper-get-function-arity": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-get-function-arity/-/helper-get-function-arity-7.16.0.tgz",
-      "integrity": "sha512-ASCquNcywC1NkYh/z7Cgp3w31YW8aojjYIlNg4VeJiHkqyP4AzIvr4qx7pYDb4/s8YcsZWqqOSxgkvjUz1kpDQ==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-get-function-arity/-/helper-get-function-arity-7.16.7.tgz",
+      "integrity": "sha512-flc+RLSOBXzNzVhcLu6ujeHUrD6tANAOU5ojrRx/as+tbzf8+stUCj7+IfRRoAbEZqj/ahXEMsjhOhgeZsrnTw==",
       "dev": true,
       "requires": {
-        "@babel/types": "^7.16.0"
+        "@babel/types": "^7.16.7"
       }
     },
     "@babel/helper-hoist-variables": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.16.0.tgz",
-      "integrity": "sha512-1AZlpazjUR0EQZQv3sgRNfM9mEVWPK3M6vlalczA+EECcPz3XPh6VplbErL5UoMpChhSck5wAJHthlj1bYpcmg==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.16.7.tgz",
+      "integrity": "sha512-m04d/0Op34H5v7pbZw6pSKP7weA6lsMvfiIAMeIvkY/R4xQtBSMFEigu9QTZ2qB/9l22vsxtM8a+Q8CzD255fg==",
       "dev": true,
       "requires": {
-        "@babel/types": "^7.16.0"
+        "@babel/types": "^7.16.7"
       }
     },
     "@babel/helper-module-imports": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.16.0.tgz",
-      "integrity": "sha512-kkH7sWzKPq0xt3H1n+ghb4xEMP8k0U7XV3kkB+ZGy69kDk2ySFW1qPi06sjKzFY3t1j6XbJSqr4mF9L7CYVyhg==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.16.7.tgz",
+      "integrity": "sha512-LVtS6TqjJHFc+nYeITRo6VLXve70xmq7wPhWTqDJusJEgGmkAACWwMiTNrvfoQo6hEhFwAIixNkvB0jPXDL8Wg==",
       "dev": true,
       "requires": {
-        "@babel/types": "^7.16.0"
+        "@babel/types": "^7.16.7"
       }
     },
     "@babel/helper-module-transforms": {
-      "version": "7.16.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.16.5.tgz",
-      "integrity": "sha512-CkvMxgV4ZyyioElFwcuWnDCcNIeyqTkCm9BxXZi73RR1ozqlpboqsbGUNvRTflgZtFbbJ1v5Emvm+lkjMYY/LQ==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.16.7.tgz",
+      "integrity": "sha512-gaqtLDxJEFCeQbYp9aLAefjhkKdjKcdh6DB7jniIGU3Pz52WAmP268zK0VgPz9hUNkMSYeH976K2/Y6yPadpng==",
       "dev": true,
       "requires": {
-        "@babel/helper-environment-visitor": "^7.16.5",
-        "@babel/helper-module-imports": "^7.16.0",
-        "@babel/helper-simple-access": "^7.16.0",
-        "@babel/helper-split-export-declaration": "^7.16.0",
-        "@babel/helper-validator-identifier": "^7.15.7",
-        "@babel/template": "^7.16.0",
-        "@babel/traverse": "^7.16.5",
-        "@babel/types": "^7.16.0"
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-module-imports": "^7.16.7",
+        "@babel/helper-simple-access": "^7.16.7",
+        "@babel/helper-split-export-declaration": "^7.16.7",
+        "@babel/helper-validator-identifier": "^7.16.7",
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.7",
+        "@babel/types": "^7.16.7"
       }
     },
     "@babel/helper-simple-access": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.16.0.tgz",
-      "integrity": "sha512-o1rjBT/gppAqKsYfUdfHq5Rk03lMQrkPHG1OWzHWpLgVXRH4HnMM9Et9CVdIqwkCQlobnGHEJMsgWP/jE1zUiw==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.16.7.tgz",
+      "integrity": "sha512-ZIzHVyoeLMvXMN/vok/a4LWRy8G2v205mNP0XOuf9XRLyX5/u9CnVulUtDgUTama3lT+bf/UqucuZjqiGuTS1g==",
       "dev": true,
       "requires": {
-        "@babel/types": "^7.16.0"
+        "@babel/types": "^7.16.7"
       }
     },
     "@babel/helper-split-export-declaration": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.16.0.tgz",
-      "integrity": "sha512-0YMMRpuDFNGTHNRiiqJX19GjNXA4H0E8jZ2ibccfSxaCogbm3am5WN/2nQNj0YnQwGWM1J06GOcQ2qnh3+0paw==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.16.7.tgz",
+      "integrity": "sha512-xbWoy/PFoxSWazIToT9Sif+jJTlrMcndIsaOKvTA6u7QEo7ilkRZpjew18/W3c7nm8fXdUDXh02VXTbZ0pGDNw==",
       "dev": true,
       "requires": {
-        "@babel/types": "^7.16.0"
+        "@babel/types": "^7.16.7"
       }
     },
     "@babel/helper-validator-identifier": {
-      "version": "7.15.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.15.7.tgz",
-      "integrity": "sha512-K4JvCtQqad9OY2+yTU8w+E82ywk/fe+ELNlt1G8z3bVGlZfn/hOcQQsUhGhW/N+tb3fxK800wLtKOE/aM0m72w==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.16.7.tgz",
+      "integrity": "sha512-hsEnFemeiW4D08A5gUAZxLBTXpZ39P+a+DGDsHw1yxqyQ/jzFEnxf5uTEGp+3bzAbNOxU1paTgYS4ECU/IgfDw==",
       "dev": true
     },
     "@babel/helper-validator-option": {
-      "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.14.5.tgz",
-      "integrity": "sha512-OX8D5eeX4XwcroVW45NMvoYaIuFI+GQpA2a8Gi+X/U/cDUIRsV37qQfF905F0htTRCREQIB4KqPeaveRJUl3Ow==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.16.7.tgz",
+      "integrity": "sha512-TRtenOuRUVo9oIQGPC5G9DgK4743cdxvtOw0weQNpZXaS16SCBi5MNjZF8vba3ETURjZpTbVn7Vvcf2eAwFozQ==",
       "dev": true
     },
     "@babel/helpers": {
-      "version": "7.16.5",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.16.5.tgz",
-      "integrity": "sha512-TLgi6Lh71vvMZGEkFuIxzaPsyeYCHQ5jJOOX1f0xXn0uciFuE8cEk0wyBquMcCxBXZ5BJhE2aUB7pnWTD150Tw==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.16.7.tgz",
+      "integrity": "sha512-9ZDoqtfY7AuEOt3cxchfii6C7GDyyMBffktR5B2jvWv8u2+efwvpnVKXMWzNehqy68tKgAfSwfdw/lWpthS2bw==",
       "dev": true,
       "requires": {
-        "@babel/template": "^7.16.0",
-        "@babel/traverse": "^7.16.5",
-        "@babel/types": "^7.16.0"
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.7",
+        "@babel/types": "^7.16.7"
       }
     },
     "@babel/highlight": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.16.0.tgz",
-      "integrity": "sha512-t8MH41kUQylBtu2+4IQA3atqevA2lRgqA2wyVB/YiWmsDSuylZZuXOUy9ric30hfzauEFfdsuk/eXTRrGrfd0g==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.16.7.tgz",
+      "integrity": "sha512-aKpPMfLvGO3Q97V0qhw/V2SWNWlwfJknuwAunU7wZLSfrM4xTBvg7E5opUVi1kJTBKihE38CPg4nBiqX83PWYw==",
       "dev": true,
       "requires": {
-        "@babel/helper-validator-identifier": "^7.15.7",
+        "@babel/helper-validator-identifier": "^7.16.7",
         "chalk": "^2.0.0",
         "js-tokens": "^4.0.0"
       },
@@ -279,36 +279,36 @@
       }
     },
     "@babel/parser": {
-      "version": "7.16.6",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.16.6.tgz",
-      "integrity": "sha512-Gr86ujcNuPDnNOY8mi383Hvi8IYrJVJYuf3XcuBM/Dgd+bINn/7tHqsj+tKkoreMbmGsFLsltI/JJd8fOFWGDQ==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.16.7.tgz",
+      "integrity": "sha512-sR4eaSrnM7BV7QPzGfEX5paG/6wrZM3I0HDzfIAK06ESvo9oy3xBuVBxE3MbQaKNhvg8g/ixjMWo2CGpzpHsDA==",
       "dev": true
     },
     "@babel/template": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.16.0.tgz",
-      "integrity": "sha512-MnZdpFD/ZdYhXwiunMqqgyZyucaYsbL0IrjoGjaVhGilz+x8YB++kRfygSOIj1yOtWKPlx7NBp+9I1RQSgsd5A==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.16.7.tgz",
+      "integrity": "sha512-I8j/x8kHUrbYRTUxXrrMbfCa7jxkE7tZre39x3kjr9hvI82cK1FfqLygotcWN5kdPGWcLdWMHpSBavse5tWw3w==",
       "dev": true,
       "requires": {
-        "@babel/code-frame": "^7.16.0",
-        "@babel/parser": "^7.16.0",
-        "@babel/types": "^7.16.0"
+        "@babel/code-frame": "^7.16.7",
+        "@babel/parser": "^7.16.7",
+        "@babel/types": "^7.16.7"
       }
     },
     "@babel/traverse": {
-      "version": "7.16.5",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.16.5.tgz",
-      "integrity": "sha512-FOCODAzqUMROikDYLYxl4nmwiLlu85rNqBML/A5hKRVXG2LV8d0iMqgPzdYTcIpjZEBB7D6UDU9vxRZiriASdQ==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.16.0",
-        "@babel/generator": "^7.16.5",
-        "@babel/helper-environment-visitor": "^7.16.5",
-        "@babel/helper-function-name": "^7.16.0",
-        "@babel/helper-hoist-variables": "^7.16.0",
-        "@babel/helper-split-export-declaration": "^7.16.0",
-        "@babel/parser": "^7.16.5",
-        "@babel/types": "^7.16.0",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.16.7.tgz",
+      "integrity": "sha512-8KWJPIb8c2VvY8AJrydh6+fVRo2ODx1wYBU2398xJVq0JomuLBZmVQzLPBblJgHIGYG4znCpUZUZ0Pt2vdmVYQ==",
+      "dev": true,
+      "requires": {
+        "@babel/code-frame": "^7.16.7",
+        "@babel/generator": "^7.16.7",
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/helper-hoist-variables": "^7.16.7",
+        "@babel/helper-split-export-declaration": "^7.16.7",
+        "@babel/parser": "^7.16.7",
+        "@babel/types": "^7.16.7",
         "debug": "^4.1.0",
         "globals": "^11.1.0"
       },
@@ -331,12 +331,12 @@
       }
     },
     "@babel/types": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.16.0.tgz",
-      "integrity": "sha512-PJgg/k3SdLsGb3hhisFvtLOw5ts113klrpLuIPtCJIU+BB24fqq6lf8RWqKJEjzqXR9AEH1rIb5XTqwBHB+kQg==",
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.16.7.tgz",
+      "integrity": "sha512-E8HuV7FO9qLpx6OtoGfUQ2cjIYnbFwvZWYBS+87EwtdMvmUPJSwykpovFB+8insbpF0uJcpr8KMUi64XZntZcg==",
       "dev": true,
       "requires": {
-        "@babel/helper-validator-identifier": "^7.15.7",
+        "@babel/helper-validator-identifier": "^7.16.7",
         "to-fast-properties": "^2.0.0"
       }
     },
@@ -694,9 +694,9 @@
       }
     },
     "agentkeepalive": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.1.4.tgz",
-      "integrity": "sha512-+V/rGa3EuU74H6wR04plBb7Ks10FbtUQgRj/FQOG7uUIEuaINI+AiqJR1k6t3SVNs7o7ZjIdus6706qqzVq8jQ==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.2.0.tgz",
+      "integrity": "sha512-0PhAp58jZNw13UJv7NVdTGb0ZcghHUb3DrZ046JiiJY/BOaTTpbwdHq2VObPCBV8M2GPh7sgrJ3AQ8Ey468LJw==",
       "dev": true,
       "requires": {
         "debug": "^4.1.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.226.3",
+  "version": "0.226.4",
   "description": "Secure markdown renderer working on browsers for user input data.",
   "private": false,
   "homepage": "https://github.com/falsandtru/securemark",

package/src/debug.test.ts

@@ -17,6 +17,7 @@ export function inspect(result: Result<HTMLElement | string>, until: number | st
         ? until
         : ~(~node.outerHTML.indexOf(until) || -Infinity) + until.length;
       const el = html('div');
+      assert(!node.outerHTML.match(/[\0\x7F]/));
       el.innerHTML = node.outerHTML.slice(0, until);
       if (node.outerHTML.length <= until) {
         assert(node.outerHTML === el.innerHTML);

package/src/parser/api/normalize.ts

@@ -1,5 +1,6 @@
-import { unsafehtmlentity } from '../inline/htmlentity';
 import { eval } from '../../combinator/data/parser';
+import { htmlentity } from '../inline/htmlentity';
+import { stringify } from '../util';
 
 const UNICODE_REPLACEMENT_CHARACTER = '\uFFFD';
 assert(UNICODE_REPLACEMENT_CHARACTER.trim());
@@ -59,8 +60,8 @@ const unreadableHTMLEntityNames = [
   'ic',
 ] as const;
 const unreadableEscapableCharacters = unreadableHTMLEntityNames
-  .flatMap(name => eval(unsafehtmlentity(`&${name};`, {}), []));
-assert(unreadableEscapableCharacters.length === unreadableHTMLEntityNames.length);
+  .map(name => stringify(eval(htmlentity(`&${name};`, {}))!));
+assert(unreadableEscapableCharacters.every(c => c.length === 1));
 const unreadableEscapableCharacter = new RegExp(`[${
   [...new Set<string>(unreadableEscapableCharacters)].join('')
 }]`, 'g');

package/src/parser/inline/comment.test.ts

@@ -16,7 +16,8 @@ describe('Unit: parser/inline/comment', () => {
       assert.deepStrictEqual(inspect(parser('[#   #]')), undefined);
       assert.deepStrictEqual(inspect(parser('[# #] #]')), undefined);
       assert.deepStrictEqual(inspect(parser('[#  #]  #]')), undefined);
-      assert.deepStrictEqual(inspect(parser(`[#  #]${'a\n'.repeat(101)}#]`)), undefined);
+      assert.deepStrictEqual(inspect(parser('[# [# ')), undefined);
+      assert.deepStrictEqual(inspect(parser('[# a [# ')), [['<sup class="comment invalid">[# a </sup>'], '[# ']);
       assert.deepStrictEqual(inspect(parser('[#a#]')), undefined);
       assert.deepStrictEqual(inspect(parser('[#a b#]')), undefined);
       assert.deepStrictEqual(inspect(parser('[#\\ a #]')), undefined);
@@ -24,8 +25,8 @@ describe('Unit: parser/inline/comment', () => {
       assert.deepStrictEqual(inspect(parser('[# a##]')), undefined);
       assert.deepStrictEqual(inspect(parser('[# a ##]')), undefined);
       assert.deepStrictEqual(inspect(parser('[## a #]')), undefined);
+      assert.deepStrictEqual(inspect(parser('[# &a; #]')), [['<sup class="comment invalid">[# &amp;a; #]</sup>'], '']);
       assert.deepStrictEqual(inspect(parser(' [# a #]')), undefined);
-      assert.deepStrictEqual(inspect(parser(`[#\na${' '.repeat(100000 - 6)}\n#`)), undefined);
     });
 
     it('basic', () => {
@@ -34,15 +35,12 @@ describe('Unit: parser/inline/comment', () => {
       assert.deepStrictEqual(inspect(parser('[# a\nb #]')), [['<sup class="comment" title="a\nb"></sup>'], '']);
       assert.deepStrictEqual(inspect(parser('[# a\\ #]')), [['<sup class="comment" title="a\\"></sup>'], '']);
       assert.deepStrictEqual(inspect(parser('[# a #] #]')), [['<sup class="comment" title="a"></sup>'], ' #]']);
-      assert.deepStrictEqual(inspect(parser('[# [# #]')), [['<sup class="comment" title="[#"></sup>'], '']);
       assert.deepStrictEqual(inspect(parser('[## a ##]')), [['<sup class="comment" title="a"></sup>'], '']);
       assert.deepStrictEqual(inspect(parser('[## #] ##]')), [['<sup class="comment" title="#]"></sup>'], '']);
       assert.deepStrictEqual(inspect(parser('[# a #]b')), [['<sup class="comment" title="a"></sup>'], 'b']);
       assert.deepStrictEqual(inspect(parser('[#\na\n#]')), [['<sup class="comment" title="a"></sup>'], '']);
-      assert.deepStrictEqual(inspect(parser(`[#\n${'a'.repeat(100000 - 6)}\n#]`)), [[`<sup class="comment" title="${'a'.repeat(100000 - 6).trim()}"></sup>`], '']);
-      assert.deepStrictEqual(inspect(parser(`[#\n${'a\n'.repeat(100)}#]`)), [[`<sup class="comment" title="${'a\n'.repeat(100).trim()}"></sup>`], '']);
-      assert.deepStrictEqual(inspect(parser(`[#\n${'a\n'.repeat(101)}#]b`)), [[`<sup class="comment invalid">${'a\n'.repeat(101).trim()}</sup>`], 'b']);
-      assert.deepStrictEqual(inspect(parser(`[#\n${'a\n'.repeat(100000 / 2 - 6 / 2)}#]b`)), [[`<sup class="comment invalid">${'a\n'.repeat(100000 / 2 - 6 / 2).trim()}</sup>`], 'b']);
+      assert.deepStrictEqual(inspect(parser('[# &copy; #]')), [['<sup class="comment" title="©"></sup>'], '']);
+      assert.deepStrictEqual(inspect(parser('[# &amp;copy; #]')), [['<sup class="comment" title="&amp;copy;"></sup>'], '']);
     });
 
   });

package/src/parser/inline/comment.ts

@@ -1,24 +1,31 @@
 import { CommentParser } from '../inline';
-import { validate, creator, match } from '../../combinator';
+import { union, some, validate, creator, match } from '../../combinator';
+import { eval } from '../../combinator/data/parser';
+import { unsafehtmlentity } from './htmlentity';
+import { unescsource } from '../source';
 import { html } from 'typed-dom';
-import { memoize } from 'spica/memoize';
-
-const closer = memoize<string, RegExp>(sharps => new RegExp(String.raw`\s${sharps}]`));
 
 export const comment: CommentParser = creator(validate('[#', match(
-  /^\[(#+)\s+(?!\s|\1\])(?:(\S[^\n]*?(?:\n.*?){0,99}?(?:\s|\n\s*))\1\])?/,
-  ([, sharps, title]) => (rest, { resources }) => {
-    if (title) return [[html('sup', {
-      class: 'comment',
-      title: title.trimEnd().replace(/\x7F.?/gs, ''),
-    })], rest];
-    assert(rest.trimStart() === rest);
-    const i = rest.search(closer(sharps));
-    if (i !== -1) return [[html('sup', {
+  /^\[(#+)\s+(?!\s|\1\])((?:\S+\s+)+?)(\1\]|(?=\[\1\s))/,
+  ([whole, , body, closer]) => (rest, context) => {
+    [whole, body] = `${whole}\0${body.trimEnd()}`.replace(/\x7F.?/gs, '').split('\0', 2);
+    if (!closer) return [[html('sup', {
       class: 'comment invalid',
       'data-invalid-syntax': 'comment',
       'data-invalid-type': 'content',
-      'data-invalid-description': 'Too many lines.',
-    }, rest.slice(0, i).trimEnd().replace(/\x7F.?/gs, ''))], rest.slice(i + sharps.length + 2)];
-    resources && (resources.budget -= 10);
+      'data-invalid-description': 'Comment syntax using the same level cannot start in another comment syntax.',
+    }, whole)], rest];
+    const title = eval(some(text)(body, context), []).join('').trim();
+    if (title.includes('\0')) return [[html('sup', {
+      class: 'comment invalid',
+      'data-invalid-syntax': 'comment',
+      'data-invalid-type': 'content',
+      'data-invalid-description': `Invalid HTML entitiy "${title.match(/\0&[0-9A-Za-z]+;/)![0].slice(1)}".`,
+    }, whole)], rest];
+    return [[html('sup', { class: 'comment', title })], rest];
   })));
+
+const text: CommentParser.TextParser = union([
+  unsafehtmlentity,
+  unescsource,
+]);

package/src/parser/inline/htmlentity.ts

@@ -1,24 +1,27 @@
 import { HTMLEntityParser, UnsafeHTMLEntityParser } from '../inline';
-import { union, validate, verify, focus, creator } from '../../combinator';
+import { union, validate, focus, creator, fmap } from '../../combinator';
 import { html } from 'typed-dom';
 
 const parser = html('textarea');
 
-export const unsafehtmlentity: UnsafeHTMLEntityParser = creator(validate('&', verify(focus(
+export const unsafehtmlentity: UnsafeHTMLEntityParser = creator(validate('&', fmap(focus(
   /^&[0-9A-Za-z]+;/,
   entity => [[(parser.innerHTML = entity, parser.value)], '']),
-  ([str]) => str[0] !== '&' || str.length < 3)));
+  ([str]) => [
+    str[0] !== '&' || str.length < 3
+      ? str
+      : `\0${str}`,
+  ])));
 
-export const htmlentity: HTMLEntityParser = creator(validate('&', focus(
-  /^&[0-9A-Za-z]+;/,
-  union([
-    unsafehtmlentity,
-    str => [[
-      html('span', {
-        class: 'invalid',
-        'data-invalid-syntax': 'htmlentity',
-        'data-invalid-type': 'syntax',
-        'data-invalid-description': 'Invalid HTML entity.',
-      }, str),
-    ], '']
-  ]))));
+export const htmlentity: HTMLEntityParser = creator(validate('&', fmap(
+  union([unsafehtmlentity]),
+  ([str]) => [
+    str[0] === '\0'
+      ? html('span', {
+          class: 'invalid',
+          'data-invalid-syntax': 'htmlentity',
+          'data-invalid-type': 'syntax',
+          'data-invalid-description': 'Invalid HTML entity.',
+        }, str.slice(1))
+      : str,
+  ])));

package/src/parser/inline/link.ts

@@ -47,7 +47,7 @@ export const link: LinkParser = lazy(() => creator(10, bind(reverse(
   ])))),
   ([params, content = []]: [string[], (HTMLElement | string)[]], rest, context) => {
     assert(params.every(p => typeof p === 'string'));
-    if (eval(some(autolink)(stringify(content), context), []).some(node => typeof node === 'object')) return;
+    if (eval(some(autolink)(stringify(content), context))?.some(node => typeof node === 'object')) return;
     assert(!html('div', content).querySelector('a, .media, .annotation, .reference') || (content[0] as HTMLElement).matches('.media'));
     const INSECURE_URI = params.shift()!;
     assert(INSECURE_URI === INSECURE_URI.trim());
@@ -158,7 +158,7 @@ function create(
 }
 
 function decode(uri: string): string {
-  if (uri.indexOf('%') === -1) return uri;
+  if (!uri.includes('%')) return uri;
   try {
     uri = decodeURI(uri);
   }

package/src/parser/inline/media.test.ts

@@ -41,6 +41,7 @@ describe('Unit: parser/inline/media', () => {
       assert.deepStrictEqual(inspect(parser('![\\ ]{b}')), undefined);
       assert.deepStrictEqual(inspect(parser('![\\\n]{b}')), undefined);
       assert.deepStrictEqual(inspect(parser('![	]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![&a;]{b}')), [['<img class="media invalid" data-src="b" alt="&amp;a;">'], '']);
       assert.deepStrictEqual(inspect(parser('![[]{b}')), undefined);
       assert.deepStrictEqual(inspect(parser('![]]{b}')), undefined);
       assert.deepStrictEqual(inspect(parser('![a]{}')), undefined);
@@ -77,6 +78,8 @@ describe('Unit: parser/inline/media', () => {
       assert.deepStrictEqual(inspect(parser('![a ]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![a  ]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![a b]{c}')), [['<a href="c" target="_blank"><img class="media" data-src="c" alt="a b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![&copy;]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="©"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![&amp;copy;]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="&amp;copy;"></a>'], '']);
       assert.deepStrictEqual(inspect(parser('!{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt=""></a>'], '']);
       assert.deepStrictEqual(inspect(parser('!{ ][ }')), [['<a href="][" target="_blank"><img class="media" data-src="][" alt=""></a>'], '']);
       assert.deepStrictEqual(inspect(parser('!{ }{ }')), [['<a href="}{" target="_blank"><img class="media" data-src="}{" alt=""></a>'], '']);

package/src/parser/inline/media.ts

@@ -29,6 +29,7 @@ export const media: MediaParser = lazy(() => creator(10, bind(verify(fmap(open(
   ([as, bs]) => bs ? [[join(as).trim() || join(as)], bs] : [[''], as]),
   ([[text]]) => text === '' || text.trim() !== ''),
   ([[text], params], rest, context) => {
+    assert(text === text.trim());
     const INSECURE_URI = params.shift()!;
     assert(INSECURE_URI === INSECURE_URI.trim());
     assert(!INSECURE_URI.match(/\s/));
@@ -40,9 +41,9 @@ export const media: MediaParser = lazy(() => creator(10, bind(verify(fmap(open(
       || (cache = context.caches?.media?.get(url.href)?.cloneNode(true))
       || html('img', { class: 'media', 'data-src': url.source, alt: text });
     assert(!el.matches('.invalid'));
-    if (!cache && !sanitize(url, el)) return [[el], rest];
-    assert(!el.matches('.invalid'));
     cache?.hasAttribute('alt') && cache?.setAttribute('alt', text);
+    if (!sanitize(el, url, text)) return [[el], rest];
+    assert(!el.matches('.invalid'));
     define(el, attributes('media', push([], el.classList), optspec, params));
     assert(el.matches('img') || !el.matches('.invalid'));
     if (context.syntax?.inline?.link === false || cache && cache.tagName !== 'IMG') return [[el], rest];
@@ -65,18 +66,9 @@ const option: MediaParser.ParameterParser.OptionParser = union([
   linkoption,
 ]);
 
-function sanitize(uri: ReadonlyURL, target: HTMLElement): boolean {
+function sanitize(target: HTMLElement, uri: ReadonlyURL, alt: string): boolean {
   assert(target.tagName === 'IMG');
   assert(!target.matches('.invalid'));
-  if (/\/\.\.?(?:\/|$)/.test('/' + uri.source.slice(0, uri.source.search(/[?#]|$/)))) {
-    define(target, {
-      class: void target.classList.add('invalid'),
-      'data-invalid-syntax': 'media',
-      'data-invalid-type': 'argument',
-      'data-invalid-description': 'Dot-segments cannot be used in media paths; use subresource paths instead.',
-    });
-    return false;
-  }
   switch (uri.protocol) {
     case 'http:':
     case 'https:':
@@ -91,5 +83,24 @@ function sanitize(uri: ReadonlyURL, target: HTMLElement): boolean {
       });
       return false;
   }
+  if (/\/\.\.?(?:\/|$)/.test('/' + uri.source.slice(0, uri.source.search(/[?#]|$/)))) {
+    define(target, {
+      class: void target.classList.add('invalid'),
+      'data-invalid-syntax': 'media',
+      'data-invalid-type': 'argument',
+      'data-invalid-description': 'Dot-segments cannot be used in media paths; use subresource paths instead.',
+    });
+    return false;
+  }
+  if (alt.includes('\0')) {
+    define(target, {
+      class: void target.classList.add('invalid'),
+      'data-invalid-syntax': 'media',
+      'data-invalid-type': 'content',
+      'data-invalid-description': `Cannot use invalid HTML entitiy "${alt.match(/&[0-9A-Za-z]+;/)![0]}".`,
+      alt: target.getAttribute('alt')?.replace(/\0/g, ''),
+    });
+    return false;
+  }
   return true;
 }

package/src/parser/inline/ruby.test.ts

@@ -14,6 +14,8 @@ describe('Unit: parser/inline/ruby', () => {
       assert.deepStrictEqual(inspect(parser('[ a](b)')), undefined);
       assert.deepStrictEqual(inspect(parser('[	a](b)')), undefined);
       assert.deepStrictEqual(inspect(parser('[	 a](b)')), undefined);
+      assert.deepStrictEqual(inspect(parser('[&a;](b)')), [['<ruby class="invalid">&amp;a;<rp>(</rp><rt>b</rt><rp>)</rp></ruby>'], '']);
+      assert.deepStrictEqual(inspect(parser('[a](&a;)')), [['<ruby class="invalid">a<rp>(</rp><rt>&amp;a;</rt><rp>)</rp></ruby>'], '']);
       assert.deepStrictEqual(inspect(parser('[a]()')), undefined);
       assert.deepStrictEqual(inspect(parser('[a]( )')), undefined);
       assert.deepStrictEqual(inspect(parser('[a\nb](c)')), undefined);
@@ -45,7 +47,8 @@ describe('Unit: parser/inline/ruby', () => {
       assert.deepStrictEqual(inspect(parser('[秦　\\　　こころ](はた　の　こころ)')), [['<ruby>秦<rp>(</rp><rt>はた</rt><rp>)</rp>　<rp>(</rp><rt>の</rt><rp>)</rp>こころ<rp>(</rp><rt>こころ</rt><rp>)</rp></ruby>'], '']);
       assert.deepStrictEqual(inspect(parser('[秦　&nbsp;　こころ](はた　の　こころ)')), [['<ruby>秦<rp>(</rp><rt>はた</rt><rp>)</rp>&nbsp;<rp>(</rp><rt>の</rt><rp>)</rp>こころ<rp>(</rp><rt>こころ</rt><rp>)</rp></ruby>'], '']);
       assert.deepStrictEqual(inspect(parser('[&&](&&)')), [['<ruby>&amp;&amp;<rp>(</rp><rt>&amp;&amp;</rt><rp>)</rp></ruby>'], '']);
-      assert.deepStrictEqual(inspect(parser('[&amp;](&amp;)')), [['<ruby>&amp;<rp>(</rp><rt>&amp;</rt><rp>)</rp></ruby>'], '']);
+      assert.deepStrictEqual(inspect(parser('[&copy;](&copy;)')), [['<ruby>©<rp>(</rp><rt>©</rt><rp>)</rp></ruby>'], '']);
+      assert.deepStrictEqual(inspect(parser('[&amp;copy;](&amp;copy;)')), [['<ruby>&amp;copy;<rp>(</rp><rt>&amp;copy;</rt><rp>)</rp></ruby>'], '']);
       assert.deepStrictEqual(inspect(parser('[*A*](*a*)')), [['<ruby>*A*<rp>(</rp><rt>*a*</rt><rp>)</rp></ruby>'], '']);
       assert.deepStrictEqual(inspect(parser('[<wbr>](<wbr>)')), [['<ruby>&lt;wbr&gt;<rp>(</rp><rt>&lt;wbr&gt;</rt><rp>)</rp></ruby>'], '']);
     });

package/src/parser/inline/ruby.ts

@@ -22,7 +22,7 @@ export const ruby: RubyParser = lazy(() => creator(bind(verify(
     tail.length === 0 && texts[texts.length - 1] === '' && texts.pop();
     switch (true) {
       case rubies.length <= texts.length:
-        return [[html('ruby', defrag(push(texts
+        return [[html('ruby', attributes(texts, rubies), defrag(push(texts
           .reduce((acc, _, i) =>
             push(acc, unshift([texts[i]],
               i < rubies.length && rubies[i]
@@ -30,7 +30,7 @@ export const ruby: RubyParser = lazy(() => creator(bind(verify(
                 : [html('rt')]))
           , []), tail)))], rest];
       case texts.length === 1 && [...texts[0]].length >= rubies.length:
-        return [[html('ruby', defrag(push([...texts[0]]
+        return [[html('ruby', attributes(texts, rubies), defrag(push([...texts[0]]
           .reduce((acc, _, i, texts) =>
             push(acc, unshift([texts[i]],
               i < rubies.length && rubies[i]
@@ -39,7 +39,7 @@ export const ruby: RubyParser = lazy(() => creator(bind(verify(
           , []), tail)))], rest];
       default:
         assert(rubies.length > 0);
-        return [[html('ruby', defrag(push(unshift(
+        return [[html('ruby', attributes(texts, rubies), defrag(push(unshift(
           [join(texts, ' ')],
           [html('rp', '('), html('rt', join(rubies, ' ').trim()), html('rp', ')')]), tail)))
         ], rest];
@@ -55,7 +55,7 @@ const text: RubyParser.TextParser = creator((source, context) => {
       case '&': {
         const result = unsafehtmlentity(source, context);
         if (result) {
-          acc[acc.length - 1] += eval(result, [source[0]])[0];
+          acc[acc.length - 1] += eval(result)[0];
           source = exec(result, source.slice(1));
           continue;
         }
@@ -79,3 +79,20 @@ const text: RubyParser.TextParser = creator((source, context) => {
     ? [[acc], '']
     : undefined;
 });
+
+function attributes(texts: string[], rubies: string[]): Record<string, string> {
+  let attrs: Record<string, string> | undefined;
+  for (const ss of [texts, rubies]) {
+    for (let i = 0; i < ss.length; ++i) {
+      if (!ss[i].includes('\0')) continue;
+      ss[i] = ss[i].replace(/\0/g, '');
+      attrs ??= {
+        class: 'invalid',
+        'data-invalid-syntax': 'ruby',
+        'data-invalid-type': ss === texts ? 'content' : 'argument',
+        'data-invalid-description': 'Invalid HTML entity.',
+      };
+    }
+  }
+  return attrs ?? {};
+}

package/src/parser/util.test.ts

@@ -6,6 +6,7 @@ describe('Unit: parser/util', () => {
       visualize(s => [[s], ''])(`[# ${'a'.repeat(100000 - 6)} #]`);
       visualize(s => [[s], ''])(`[# ${'a\n'.repeat(100000 / 2 - 6 / 2)} #]`);
       visualize(s => [[s], ''])(`[# a${' '.repeat(100000 - 6)} #`);
+      visualize(s => [[s], ''])(`${'[# '.repeat(100000 - 2)}a #]`);
     });
 
   });

package/src/parser/util.ts

@@ -42,7 +42,7 @@ const invisibleHTMLEntityNames = [
   'InvisibleComma',
   'ic',
 ];
-const blankline = new RegExp(String.raw`^(?!$|\n)(?:\\?\s|&(?:${invisibleHTMLEntityNames.join('|')});|<wbr>|\[(#+)\s+(?!\s|\1\])\S[^\n]*?(?:\n.*?){0,99}?(?:\s|\n\s*)\1\])*\\?(?:$|\n)`, 'gm');
+const blankline = new RegExp(String.raw`^(?!$|\n)(?:\\?\s|&(?:${invisibleHTMLEntityNames.join('|')});|<wbr>|\[(#+)\s+(?!\s|\1\])(?:\S+\s+)+?(?:\1\]|(?=\[\1\s)))*\\?(?:$|\n)`, 'gm');
 
 export function visualize<P extends Parser<HTMLElement | string>>(parser: P): P;
 export function visualize<T extends HTMLElement | string>(parser: Parser<T>): Parser<T> {
@@ -104,7 +104,7 @@ function isStartTight(source: string, context: MarkdownParser.Context): boolean
       switch (true) {
         case source.length > 2
           && source[1] !== ' '
-          && eval(unsafehtmlentity(source, context))?.[0].trimStart() === '':
+          && eval(unsafehtmlentity(source, context))?.[0]?.trimStart() === '':
           return false;
       }
       return true;