securemark 0.253.2 → 0.254.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.254.0
+
+- Remove `sup`, `sub`, and `small` HTML tags.
+
 ## 0.253.2
 
 - Refactoring.

package/README.md

@@ -43,7 +43,7 @@ https://falsandtru.github.io/securemark/
 - Preformattedtext (```)
 - HorizontalRule (---)
 - Inline markups (*, `, []{}, {}, ![]{}, !{}, \[](), ++, ~~, (()), ...)
-- Inline HTML tags (\<small>, \<bdi>, ...)
+- Inline HTML tags (\<bdi>, \<bdo>)
 - Autolink (https://host, user@host, @user)
 - Shortmedia (!https://host/image.png, !https://youtu.be/...)
 - Syntex highlight (```lang filename)

package/design.md

@@ -307,3 +307,9 @@ MarkdownはGFMのように最初から高機能で完成度の高い拡張不要
 
 Data URIは保存および転送容量削減ならびにユーザーおよび管理者双方の集約的管理のためサポートしない。
 特に規制および公開レベルの媒体別設定の実現のためテキストとメディアの分離が必須となる。
+
+### HTML
+
+- \<small>: 法的表記を縮小表示すべきでないため削除。
+- \<sub>: \<small>の代わりに使用されないよう削除。他の構文との相性も悪い。
+- \<sup>: 同上。

package/dist/index.js

@@ -1,4 +1,4 @@
-/*! securemark v0.253.2 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED License */
+/*! securemark v0.254.0 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED License */
 (function webpackUniversalModuleDefinition(root, factory) {
 	if(typeof exports === 'object' && typeof module === 'object')
 		module.exports = factory(require("DOMPurify"), require("Prism"));
@@ -4514,7 +4514,8 @@ function format(rows) {
     let lHeadCellIdx;
     let rHeadCellIdx;
 
-    for (let j = 0, jn = 0n; j < cells.length; jn = (0, global_1.BigInt)(++j)) {
+    for (let j = 0; j < cells.length; ++j) {
+      const jn = (0, global_1.BigInt)(j);
       const isVirtual = !!ranges[i]?.[j];
       const cell = isVirtual ? (0, array_1.splice)(cells, j, 0, global_1.undefined) && ranges[i][j] : cells[j];
       const isHeadCell = cell.tagName === 'TH';
@@ -4545,8 +4546,8 @@ function format(rows) {
 
       if (colSpan > 1) {
         (0, array_1.splice)(cells, j + 1, 0, ...(0, global_1.Array)(colSpan - 1));
-        heads |= heads & 1n << jn ? ~(~0n << (0, global_1.BigInt)(colSpan)) << jn : 0n;
-        highlights |= highlights & 1n << jn ? ~(~0n << (0, global_1.BigInt)(colSpan)) << jn : 0n;
+        heads |= heads & 1n << jn && ~(~0n << (0, global_1.BigInt)(colSpan)) << jn;
+        highlights |= highlights & 1n << jn && ~(~0n << (0, global_1.BigInt)(colSpan)) << jn;
         j += colSpan - 1;
       }
 
@@ -6209,21 +6210,24 @@ const cache_1 = __webpack_require__(9210);
 
 const array_1 = __webpack_require__(8112);
 
-const tags = global_1.Object.freeze(['sup', 'sub', 'small', 'bdo', 'bdi']);
-const attrspec = {
+const tags = global_1.Object.freeze(['bdo', 'bdi']);
+const attrspecs = {
   bdo: {
     dir: global_1.Object.freeze(['ltr', 'rtl'])
   }
 };
-global_1.Object.setPrototypeOf(attrspec, null);
-global_1.Object.values(attrspec).forEach(o => global_1.Object.setPrototypeOf(o, null));
+global_1.Object.setPrototypeOf(attrspecs, null);
+global_1.Object.values(attrspecs).forEach(o => global_1.Object.setPrototypeOf(o, null));
 exports.html = (0, combinator_1.lazy)(() => (0, combinator_1.creator)((0, combinator_1.validate)('<', (0, combinator_1.validate)(/^<[a-z]+(?=[^\S\n]|>)/, (0, combinator_1.union)([(0, combinator_1.focus)('<wbr>', () => [[(0, dom_1.html)('wbr')], '']), (0, combinator_1.focus)( // https://html.spec.whatwg.org/multipage/syntax.html#void-elements
-/^<(?:area|base|br|col|embed|hr|img|input|link|meta|source|track|wbr)(?=[^\S\n]|>)/, source => [[source], '']), (0, combinator_1.match)(/^<(sup|sub|small|bdo|bdi)(?=[^\S\n]|>)/, (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${tag}`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)(/^[^\S\n]*>/), true), (0, util_1.startLoose)((0, combinator_1.some)((0, combinator_1.union)([(0, combinator_1.open)(/^\n?/, (0, combinator_1.some)(inline_1.inline, (0, util_1.blankWith)('\n', `</${tag}>`)), true)])), `</${tag}>`), (0, source_1.str)(`</${tag}>`), false, ([as, bs, cs], rest) => [[elem(tag, as, bs, cs)], rest]), ([, tag]) => tags.indexOf(tag), [])), (0, combinator_1.match)(/^<([a-z]+)(?=[^\S\n]|>)/, (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${tag}`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)(/^[^\S\n]*>/), true), (0, util_1.startLoose)((0, combinator_1.some)((0, combinator_1.union)([(0, combinator_1.open)(/^\n?/, (0, combinator_1.some)(inline_1.inline, (0, util_1.blankWith)('\n', `</${tag}>`)), true)])), `</${tag}>`), (0, source_1.str)(`</${tag}>`), false, ([as, bs, cs], rest) => [[elem(tag, as, bs, cs)], rest]), ([, tag]) => tag, new cache_1.Cache(10000)))])))));
-exports.attribute = (0, combinator_1.union)([(0, source_1.str)(/^[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|>)/)]);
+/^<(?:area|base|br|col|embed|hr|img|input|link|meta|source|track|wbr)(?=[^\S\n]|>)/, source => [[source], '']), (0, combinator_1.match)(new RegExp(String.raw`^<(${TAGS.join('|')})(?=[^\S\n]|>)`), (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${tag}`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)(/^[^\S\n]*>/), true), (0, util_1.startLoose)((0, combinator_1.some)((0, combinator_1.union)([(0, combinator_1.open)(/^\n?/, (0, combinator_1.some)(inline_1.inline, (0, util_1.blankWith)('\n', `</${tag}>`)), true)])), `</${tag}>`), (0, source_1.str)(`</${tag}>`), false, ([as, bs, cs], rest) => [[elem(tag, as, bs, cs)], rest]), ([, tag]) => TAGS.indexOf(tag), [])), (0, combinator_1.match)(/^<([a-z]+)(?=[^\S\n]|>)/, (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${tag}`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)(/^[^\S\n]*>/), true), (0, util_1.startLoose)((0, combinator_1.some)((0, combinator_1.union)([(0, combinator_1.open)(/^\n?/, (0, combinator_1.some)(inline_1.inline, (0, util_1.blankWith)('\n', `</${tag}>`)), true)])), `</${tag}>`), (0, source_1.str)(`</${tag}>`), false, ([as, bs, cs], rest) => [[elem(tag, as, bs, cs)], rest]), ([, tag]) => tag, new cache_1.Cache(10000)))])))));
+exports.attribute = (0, combinator_1.union)([(0, source_1.str)(/^[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|>)/)]); // https://developer.mozilla.org/en-US/docs/Web/HTML/Element
+// [...document.querySelectorAll('tbody > tr > td:first-child')].map(el => el.textContent.slice(1, -1))
+
+const TAGS = global_1.Object.freeze(["html", "base", "head", "link", "meta", "style", "title", "body", "address", "article", "aside", "footer", "header", "h1", "h2", "h3", "h4", "h5", "h6", "main", "nav", "section", "blockquote", "dd", "div", "dl", "dt", "figcaption", "figure", "hr", "li", "menu", "ol", "p", "pre", "ul", "a", "abbr", "b", "bdi", "bdo", "br", "cite", "code", "data", "dfn", "em", "i", "kbd", "mark", "q", "rp", "rt", "ruby", "s", "samp", "small", "span", "strong", "sub", "sup", "time", "u", "var", "wbr", "area", "audio", "img", "map", "track", "video", "embed", "iframe", "object", "picture", "portal", "source", "svg", "math", "canvas", "noscript", "script", "del", "ins", "caption", "col", "colgroup", "table", "tbody", "td", "tfoot", "th", "thead", "tr", "button", "datalist", "fieldset", "form", "input", "label", "legend", "meter", "optgroup", "option", "output", "progress", "select", "textarea", "details", "dialog", "summary", "slot", "template", "acronym", "applet", "basefont", "bgsound", "big", "blink", "center", "content", "dir", "font", "frame", "frameset", "hgroup", "image", "keygen", "marquee", "menuitem", "nobr", "noembed", "noframes", "param", "plaintext", "rb", "rtc", "shadow", "spacer", "strike", "tt", "xmp"]);
 
 function elem(tag, as, bs, cs) {
   if (!tags.includes(tag)) return invalid('tag', `Invalid HTML tag <${tag}>`, as, bs, cs);
-  const attrs = attributes('html', [], attrspec[tag], as.slice(1, -1));
+  const attrs = attributes('html', [], attrspecs[tag], as.slice(1, -1));
   return 'data-invalid-syntax' in attrs ? invalid('attribute', 'Invalid HTML attribute', as, bs, cs) : (0, dom_1.html)(tag, attrs, (0, dom_1.defrag)(bs));
 }
 
@@ -6247,7 +6251,7 @@ function attributes(syntax, classes, spec, params) {
     const name = param.split('=', 1)[0];
     const value = param !== name ? param.slice(name.length + 2, -1).replace(/\\(.?)/g, '$1') : global_1.undefined;
     invalid ||= !spec || name in attrs;
-    if (spec && !spec[name] && name in spec) continue;
+    if (spec && name in spec && !spec[name]) continue;
     spec?.[name]?.includes(value) || value !== global_1.undefined && spec?.[name]?.length === 0 ? attrs[name] = value ?? '' : invalid ||= !!spec;
     (0, array_1.splice)(params, i--, 1);
   }

package/markdown.d.ts

@@ -964,8 +964,8 @@ export namespace MarkdownParser {
       }
     }
     export interface HTMLParser extends
-      // Allow: wbr, sup, sub, small, bdo, bdi
-      // <small>abc</small>
+      // Allow: wbr, bdo, bdi
+      // <bdi>abc</bdi>
       Inline<'html'>,
       Parser<HTMLElement | string, Context, [
         HTMLParser.OpenTagParser,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.253.2",
+  "version": "0.254.0",
   "description": "Secure markdown renderer working on browsers for user input data.",
   "private": false,
   "homepage": "https://github.com/falsandtru/securemark",

package/src/parser/block/extension/table.ts

@@ -220,7 +220,8 @@ function format(rows: Tree<RowParser>[]): HTMLTableSectionElement[] {
     let hasDataCell = false;
     let lHeadCellIdx: bigint;
     let rHeadCellIdx: bigint;
-    for (let j = 0, jn = 0n; j < cells.length; jn = BigInt(++j)) {
+    for (let j = 0; j < cells.length; ++j) {
+      const jn = BigInt(j);
       const isVirtual = !!ranges[i]?.[j];
       const cell = isVirtual
         ? splice(cells, j, 0, undefined) && ranges[i][j]
@@ -248,12 +249,8 @@ function format(rows: Tree<RowParser>[]): HTMLTableSectionElement[] {
       assert(colSpan > 0);
       if (colSpan > 1) {
         splice(cells, j + 1, 0, ...Array(colSpan - 1));
-        heads |= heads & 1n << jn
-          ? ~(~0n << BigInt(colSpan)) << jn
-          : 0n;
-        highlights |= highlights & 1n << jn
-          ? ~(~0n << BigInt(colSpan)) << jn
-          : 0n;
+        heads |= heads & 1n << jn && ~(~0n << BigInt(colSpan)) << jn;
+        highlights |= highlights & 1n << jn && ~(~0n << BigInt(colSpan)) << jn;
         j += colSpan - 1;
       }
       if (target === thead) {
@@ -315,7 +312,7 @@ function format(rows: Tree<RowParser>[]): HTMLTableSectionElement[] {
             'v c',
             'v h',
             'v h c',
-          ][+!!(highlights & m) + +!!(lHighlight | rHighlight) * 2 + +!!(tHighlights & m) * 4]));
+          ][+!!(highlights & m) | +!!(lHighlight | rHighlight) << 1 | +!!(tHighlights & m) << 2]));
         }
         continue;
       case tfoot:

package/src/parser/inline/emphasis.test.ts

@@ -46,7 +46,7 @@ describe('Unit: parser/inline/emphasis', () => {
       assert.deepStrictEqual(inspect(parser('*a**b**c*')), [['<em>a<strong>b</strong>c</em>'], '']);
       assert.deepStrictEqual(inspect(parser('*a**b**c*d')), [['<em>a<strong>b</strong>c</em>'], 'd']);
       assert.deepStrictEqual(inspect(parser('*`a`*')), [['<em><code data-src="`a`">a</code></em>'], '']);
-      assert.deepStrictEqual(inspect(parser('*<small>*')), [['<em>&lt;small&gt;</em>'], '']);
+      assert.deepStrictEqual(inspect(parser('*<bdi>*')), [['<em>&lt;bdi&gt;</em>'], '']);
       assert.deepStrictEqual(inspect(parser('*(*a*)*')), [['<em><span class="paren">(<em>a</em>)</span></em>'], '']);
       assert.deepStrictEqual(inspect(parser('*(**a**)*')), [['<em><span class="paren">(<strong>a</strong>)</span></em>'], '']);
     });

package/src/parser/inline/html.test.ts

@@ -11,10 +11,10 @@ describe('Unit: parser/inline/html', () => {
       assert.deepStrictEqual(inspect(parser('<script>alert()<script>')), undefined);
       assert.deepStrictEqual(inspect(parser('<script>alert()</script>')), [['<span class="invalid">&lt;script&gt;alert<span class="paren">()</span>&lt;/script&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<script src="\\""></script>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small onclick="alert()">')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small onclick="alert()"></small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small onclick="alert()">a</small>')), [['<span class="invalid">&lt;small onclick="alert()"&gt;a&lt;/small&gt;</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small><small onclick="alert()">a</small></small>')), [['<small><span class="invalid">&lt;small onclick="alert()"&gt;a&lt;/small&gt;</span></small>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi onclick="alert()">')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi onclick="alert()"></bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi onclick="alert()">a</bdi>')), [['<span class="invalid">&lt;bdi onclick="alert()"&gt;a&lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi><bdi onclick="alert()">a</bdi></bdi>')), [['<bdi><span class="invalid">&lt;bdi onclick="alert()"&gt;a&lt;/bdi&gt;</span></bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdo dir="rtl\\"><">a</bdo>')), [['<span class="invalid">&lt;bdo dir="rtl\\"&gt;&lt;"&gt;a&lt;/bdo&gt;</span>'], '']);
     });
 
@@ -25,80 +25,80 @@ describe('Unit: parser/inline/html', () => {
       assert.deepStrictEqual(inspect(parser('<a,b>')), undefined);
       assert.deepStrictEqual(inspect(parser('<a, b>')), undefined);
       assert.deepStrictEqual(inspect(parser('<T>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small>z')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small></small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small> </small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small>\\ </small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small>&Tab;</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small><wbr></small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small>\n</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small>\na</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small>\\\na</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small>a')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small>a</BDO>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<SMALL>a</SMALL>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<SMALL>a</bdo>')), undefined);
-      assert.deepStrictEqual(inspect(parser('</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small/>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi>z')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi></bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi> </bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi>\\ </bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi>&Tab;</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi><wbr></bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi>\n</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi>\na</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi>\\\na</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi>a')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi>a</BDO>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<BDI>a</BDI>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<BDI>a</bdo>')), undefined);
+      assert.deepStrictEqual(inspect(parser('</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi/>')), undefined);
       assert.deepStrictEqual(inspect(parser('<b><b><b>a</b></b></b>')), [['<span class="invalid">&lt;b&gt;<span class="invalid">&lt;b&gt;<span class="invalid">&lt;b&gt;a&lt;/b&gt;</span>&lt;/b&gt;</span>&lt;/b&gt;</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small><small><small>a</small></small></small>')), [['<small><small><small>a</small></small></small>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi><bdi><bdi>a</bdi></bdi></bdi>')), [['<bdi><bdi><bdi>a</bdi></bdi></bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<x a="*b*"')), undefined);
       assert.deepStrictEqual(inspect(parser('<x a="*b*">')), undefined);
       assert.deepStrictEqual(inspect(parser('<x a="*b*">c')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small a="*b*"')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small a="*b*">')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small a="*b*">c')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small a b="*" *c*')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small a b="*" *c*>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small a b="*" *c*>d</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small a b="*" *>*c*')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small a b="*" *>*c*</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser(' <small>a</small>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi a="*b*"')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi a="*b*">')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi a="*b*">c')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi a b="*" *c*')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi a b="*" *c*>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi a b="*" *c*>d</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi a b="*" *>*c*')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi a b="*" *>*c*</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser(' <bdi>a</bdi>')), undefined);
     });
 
     it('basic', () => {
-      assert.deepStrictEqual(inspect(parser('<small> a</small>')), [['<small> a</small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small> a </small>')), [['<small> a </small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>  a  </small>')), [['<small>  a  </small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>\\ a</small>')), [['<small> a</small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small><wbr>a</small>')), [['<small><wbr>a</small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>a</small>')), [['<small>a</small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>a</small>a')), [['<small>a</small>'], 'a']);
-      assert.deepStrictEqual(inspect(parser('<small>a </small>')), [['<small>a </small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>a \n </small>')), [['<small>a </small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>a\n</small>')), [['<small>a</small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>a\n </small>')), [['<small>a </small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>a\n<wbr></small>')), [['<small>a<wbr></small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>a\nb</small>')), [['<small>a<br>b</small>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi> a</bdi>')), [['<bdi> a</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi> a </bdi>')), [['<bdi> a </bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>  a  </bdi>')), [['<bdi>  a  </bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>\\ a</bdi>')), [['<bdi> a</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi><wbr>a</bdi>')), [['<bdi><wbr>a</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a</bdi>')), [['<bdi>a</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a</bdi>a')), [['<bdi>a</bdi>'], 'a']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a </bdi>')), [['<bdi>a </bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a \n </bdi>')), [['<bdi>a </bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a\n</bdi>')), [['<bdi>a</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a\n </bdi>')), [['<bdi>a </bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a\n<wbr></bdi>')), [['<bdi>a<wbr></bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a\nb</bdi>')), [['<bdi>a<br>b</bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<wbr>a')), [['<wbr>'], 'a']);
     });
 
     it('nest', () => {
-      assert.deepStrictEqual(inspect(parser('<small><small>a</small></small>')), [['<small><small>a</small></small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>a<small>b</small>c</small>')), [['<small>a<small>b</small>c</small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>`a`</small>')), [['<small><code data-src="`a`">a</code></small>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi><bdi>a</bdi></bdi>')), [['<bdi><bdi>a</bdi></bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a<bdi>b</bdi>c</bdi>')), [['<bdi>a<bdi>b</bdi>c</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>`a`</bdi>')), [['<bdi><code data-src="`a`">a</code></bdi>'], '']);
     });
 
     it('escape', () => {
       assert.deepStrictEqual(inspect(parser('<a>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small><a>a</a></small>')), [['<small><span class="invalid">&lt;a&gt;a&lt;/a&gt;</span></small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>a<a>b</a>c</small>')), [['<small>a<span class="invalid">&lt;a&gt;b&lt;/a&gt;</span>c</small>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi><a>a</a></bdi>')), [['<bdi><span class="invalid">&lt;a&gt;a&lt;/a&gt;</span></bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a<a>b</a>c</bdi>')), [['<bdi>a<span class="invalid">&lt;a&gt;b&lt;/a&gt;</span>c</bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<img>')), [['<img'], '>']);
-      assert.deepStrictEqual(inspect(parser('<small><img></small>')), [['<small>&lt;img&gt;</small>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi><img></bdi>')), [['<bdi>&lt;img&gt;</bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<img />')), [['<img'], ' />']);
-      assert.deepStrictEqual(inspect(parser('<small><img /></small>')), [['<small>&lt;img /&gt;</small>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi><img /></bdi>')), [['<bdi>&lt;img /&gt;</bdi>'], '']);
     });
 
     it('attribute', () => {
-      assert.deepStrictEqual(inspect(parser('<small\n>a</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small >a</small>')), [['<small>a</small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small \n>a</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small  >a</small>')), [['<small>a</small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small __proto__>a</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small constructor>a</small>')), [['<span class="invalid">&lt;small constructor&gt;a&lt;/small&gt;</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small toString>a</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small X>a</small>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<small x>a</small>')), [['<span class="invalid">&lt;small x&gt;a&lt;/small&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi\n>a</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi >a</bdi>')), [['<bdi>a</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi \n>a</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi  >a</bdi>')), [['<bdi>a</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi __proto__>a</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi constructor>a</bdi>')), [['<span class="invalid">&lt;bdi constructor&gt;a&lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi toString>a</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi X>a</bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi x>a</bdi>')), [['<span class="invalid">&lt;bdi x&gt;a&lt;/bdi&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdo>a</bdo>')), [['<span class="invalid">&lt;bdo&gt;a&lt;/bdo&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdo >a</bdo>')), [['<span class="invalid">&lt;bdo &gt;a&lt;/bdo&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdo __proto__>a</bdo>')), undefined);

package/src/parser/inline/html.ts

@@ -9,14 +9,14 @@ import { memoize } from 'spica/memoize';
 import { Cache } from 'spica/cache';
 import { unshift, push, splice } from 'spica/array';
 
-const tags = Object.freeze(['sup', 'sub', 'small', 'bdo', 'bdi']);
-const attrspec = {
+const tags = Object.freeze(['bdo', 'bdi']);
+const attrspecs = {
   bdo: {
-    dir: Object.freeze(['ltr', 'rtl'] as const),
+    dir: Object.freeze(['ltr', 'rtl']),
   },
 } as const;
-Object.setPrototypeOf(attrspec, null);
-Object.values(attrspec).forEach(o => Object.setPrototypeOf(o, null));
+Object.setPrototypeOf(attrspecs, null);
+Object.values(attrspecs).forEach(o => Object.setPrototypeOf(o, null));
 
 export const html: HTMLParser = lazy(() => creator(validate('<', validate(/^<[a-z]+(?=[^\S\n]|>)/, union([
   focus(
@@ -27,7 +27,7 @@ export const html: HTMLParser = lazy(() => creator(validate('<', validate(/^<[a-
     /^<(?:area|base|br|col|embed|hr|img|input|link|meta|source|track|wbr)(?=[^\S\n]|>)/,
     source => [[source], '']),
   match(
-    /^<(sup|sub|small|bdo|bdi)(?=[^\S\n]|>)/,
+    new RegExp(String.raw`^<(${TAGS.join('|')})(?=[^\S\n]|>)`),
     memoize(
     ([, tag]) =>
       surround<HTMLParser.TagParser, string>(surround(
@@ -38,7 +38,7 @@ export const html: HTMLParser = lazy(() => creator(validate('<', validate(/^<[a-
         str(`</${tag}>`), false,
         ([as, bs, cs], rest) =>
           [[elem(tag, as, bs, cs)], rest]),
-    ([, tag]) => tags.indexOf(tag), [])),
+    ([, tag]) => TAGS.indexOf(tag), [])),
   match(
     /^<([a-z]+)(?=[^\S\n]|>)/,
     memoize(
@@ -59,16 +59,159 @@ export const attribute: HTMLParser.TagParser.AttributeParser = union([
   str(/^[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|>)/),
 ]);
 
+// https://developer.mozilla.org/en-US/docs/Web/HTML/Element
+// [...document.querySelectorAll('tbody > tr > td:first-child')].map(el => el.textContent.slice(1, -1))
+const TAGS = Object.freeze([
+  "html",
+  "base",
+  "head",
+  "link",
+  "meta",
+  "style",
+  "title",
+  "body",
+  "address",
+  "article",
+  "aside",
+  "footer",
+  "header",
+  "h1", "h2", "h3", "h4", "h5", "h6",
+  "main",
+  "nav",
+  "section",
+  "blockquote",
+  "dd",
+  "div",
+  "dl",
+  "dt",
+  "figcaption",
+  "figure",
+  "hr",
+  "li",
+  "menu",
+  "ol",
+  "p",
+  "pre",
+  "ul",
+  "a",
+  "abbr",
+  "b",
+  "bdi",
+  "bdo",
+  "br",
+  "cite",
+  "code",
+  "data",
+  "dfn",
+  "em",
+  "i",
+  "kbd",
+  "mark",
+  "q",
+  "rp",
+  "rt",
+  "ruby",
+  "s",
+  "samp",
+  "small",
+  "span",
+  "strong",
+  "sub",
+  "sup",
+  "time",
+  "u",
+  "var",
+  "wbr",
+  "area",
+  "audio",
+  "img",
+  "map",
+  "track",
+  "video",
+  "embed",
+  "iframe",
+  "object",
+  "picture",
+  "portal",
+  "source",
+  "svg",
+  "math",
+  "canvas",
+  "noscript",
+  "script",
+  "del",
+  "ins",
+  "caption",
+  "col",
+  "colgroup",
+  "table",
+  "tbody",
+  "td",
+  "tfoot",
+  "th",
+  "thead",
+  "tr",
+  "button",
+  "datalist",
+  "fieldset",
+  "form",
+  "input",
+  "label",
+  "legend",
+  "meter",
+  "optgroup",
+  "option",
+  "output",
+  "progress",
+  "select",
+  "textarea",
+  "details",
+  "dialog",
+  "summary",
+  "slot",
+  "template",
+  "acronym",
+  "applet",
+  "basefont",
+  "bgsound",
+  "big",
+  "blink",
+  "center",
+  "content",
+  "dir",
+  "font",
+  "frame",
+  "frameset",
+  "hgroup",
+  "image",
+  "keygen",
+  "marquee",
+  "menuitem",
+  "nobr",
+  "noembed",
+  "noframes",
+  "param",
+  "plaintext",
+  "rb",
+  "rtc",
+  "shadow",
+  "spacer",
+  "strike",
+  "tt",
+  "xmp",
+]);
+
 function elem(tag: string, as: string[], bs: (HTMLElement | string)[], cs: string[]): HTMLElement {
   assert(as.length > 0);
   assert(as[0][0] === '<' && as[as.length - 1].slice(-1) === '>');
   assert(cs.length === 1);
   if (!tags.includes(tag)) return invalid('tag', `Invalid HTML tag <${tag}>`, as, bs, cs);
-  const attrs = attributes('html', [], attrspec[tag], as.slice(1, -1));
+  const attrs = attributes('html', [], attrspecs[tag], as.slice(1, -1));
   return 'data-invalid-syntax' in attrs
     ? invalid('attribute', 'Invalid HTML attribute', as, bs, cs)
     : h(tag as 'span', attrs, defrag(bs));
 }
+
 function invalid(type: string, message: string, as: (HTMLElement | string)[], bs: (HTMLElement | string)[], cs: (HTMLElement | string)[]): HTMLElement {
   return h('span', {
     class: 'invalid',
@@ -101,7 +244,7 @@ export function attributes(
       ? param.slice(name.length + 2, -1).replace(/\\(.?)/g, '$1')
       : undefined;
     invalid ||= !spec || name in attrs;
-    if (spec && !spec[name] && name in spec) continue;
+    if (spec && name in spec && !spec[name]) continue;
     spec?.[name]?.includes(value) || value !== undefined && spec?.[name]?.length === 0
       ? attrs[name] = value ?? ''
       : invalid ||= !!spec;

package/src/parser/inline/strong.test.ts

@@ -43,7 +43,7 @@ describe('Unit: parser/inline/strong', () => {
       assert.deepStrictEqual(inspect(parser('**a*b*c**')), [['<strong>a<em>b</em>c</strong>'], '']);
       assert.deepStrictEqual(inspect(parser('**a*b*c**d')), [['<strong>a<em>b</em>c</strong>'], 'd']);
       assert.deepStrictEqual(inspect(parser('**`a`**')), [['<strong><code data-src="`a`">a</code></strong>'], '']);
-      assert.deepStrictEqual(inspect(parser('**<small>**')), [['<strong>&lt;small&gt;</strong>'], '']);
+      assert.deepStrictEqual(inspect(parser('**<bdi>**')), [['<strong>&lt;bdi&gt;</strong>'], '']);
       assert.deepStrictEqual(inspect(parser('**(*a*)**')), [['<strong><span class="paren">(<em>a</em>)</span></strong>'], '']);
       assert.deepStrictEqual(inspect(parser('**(**a**)**')), [['<strong><span class="paren">(<strong>a</strong>)</span></strong>'], '']);
     });

package/src/parser/inline.test.ts

@@ -99,8 +99,8 @@ describe('Unit: parser/inline', () => {
       assert.deepStrictEqual(inspect(parser('*++ ++*')), [['<em><ins> </ins></em>'], '']);
       assert.deepStrictEqual(inspect(parser('*++ a ++*')), [['<em><ins> a </ins></em>'], '']);
       assert.deepStrictEqual(inspect(parser('*++  a  ++*')), [['<em><ins>  a  </ins></em>'], '']);
-      assert.deepStrictEqual(inspect(parser('*<small>`a`</small>*')), [['<em><small><code data-src="`a`">a</code></small></em>'], '']);
-      assert.deepStrictEqual(inspect(parser('<small>*<bdi>a</bdi>*</small>')), [['<small><em><bdi>a</bdi></em></small>'], '']);
+      assert.deepStrictEqual(inspect(parser('*<bdi>`a`</bdi>*')), [['<em><bdi><code data-src="`a`">a</code></bdi></em>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>*<bdi>a</bdi>*</bdi>')), [['<bdi><em><bdi>a</bdi></em></bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi>((<bdi>((a))</bdi>))</bdi>')), [['<bdi><sup class="annotation"><span><bdi><span class="paren">((a))</span></bdi></span></sup></bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi>[[<bdi>[[a]]</bdi>]]</bdi>')), [['<bdi><sup class="reference"><span><bdi>[[a]]</bdi></span></sup></bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('*[*]')), [['*', '[', '*', ']'], '']);
@@ -155,9 +155,8 @@ describe('Unit: parser/inline', () => {
       assert.deepStrictEqual(inspect(parser('[(([a]{#}))]{#}')), [['<a href="#"><span class="paren">(<span class="paren">([a]{#})</span>)</span></a>'], '']);
       assert.deepStrictEqual(inspect(parser('"[[""]]')), [['"', '<sup class="reference"><span>""</span></sup>'], '']);
       assert.deepStrictEqual(inspect(parser('<http://host>')), [['<', '<a href="http://host" target="_blank">http://host</a>', '>'], '']);
-      assert.deepStrictEqual(inspect(parser('<<small>a<</small>')), [['<', '<small>a&lt;</small>'], '']);
-      assert.deepStrictEqual(inspect(parser('<sup><sub>a</sub>')), [['<', 'sup', '>', '<sub>a</sub>'], '']);
-      assert.deepStrictEqual(inspect(parser('*<small>*`</small>`')), [['<em>&lt;small&gt;</em>', '<code data-src="`</small>`">&lt;/small&gt;</code>'], '']);
+      assert.deepStrictEqual(inspect(parser('<<bdi>a<</bdi>')), [['<', '<bdi>a&lt;</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('*<bdi>*`</bdi>`')), [['<em>&lt;bdi&gt;</em>', '<code data-src="`</bdi>`">&lt;/bdi&gt;</code>'], '']);
       assert.deepStrictEqual(inspect(parser('[~http://host')), [['[', '~', '<a href="http://host" target="_blank">http://host</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[~a@b')), [['[', '~', '<a class="email" href="mailto:a@b">a@b</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[~~a~~]')), [['[', '<del>a</del>', ']'], '']);