securemark 0.291.0 → 0.292.0

package/src/parser/inline/media.test.ts

@@ -1,117 +1,119 @@
 import { media } from './media';
 import { some } from '../../combinator';
+import { input } from '../../combinator/data/parser';
 import { inspect } from '../../debug.test';
 
 describe('Unit: parser/inline/media', () => {
   describe('media', () => {
-    const parser = (source: string) => some(media)({ source, context: {} });
+    const parser = (source: string) => some(media)(input(source, ctx));
+    const { context: ctx } = input('', {});
 
     it('xss', () => {
-      assert.deepStrictEqual(inspect(parser('![]{javascript:alert}')), [['<img class="invalid" alt="javascript:alert">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{vbscript:alert}')), [['<img class="invalid" alt="vbscript:alert">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K}')), [['<img class="invalid" alt="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{any:alert}')), [['<img class="invalid" alt="any:alert">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{"}')), [['<a href="&quot;" target="_blank"><img class="media" data-src="&quot;" alt="&quot;"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{\\}')), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt="\\"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![\\"]{/}')), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="&quot;"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{javascript:alert}'), ctx), [['<img class="invalid" alt="javascript:alert">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{vbscript:alert}'), ctx), [['<img class="invalid" alt="vbscript:alert">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K}'), ctx), [['<img class="invalid" alt="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{any:alert}'), ctx), [['<img class="invalid" alt="any:alert">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{"}'), ctx), [['<a href="&quot;" target="_blank"><img class="media" data-src="&quot;" alt="&quot;"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{\\}'), ctx), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt="\\"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![\\"]{/}'), ctx), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="&quot;"></a>'], '']);
     });
 
     it('invalid', () => {
-      assert.deepStrictEqual(inspect(parser('')), undefined);
-      assert.deepStrictEqual(inspect(parser('{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[]')), undefined);
-      assert.deepStrictEqual(inspect(parser('!{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{ }')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{  }')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{   }')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]]{/}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{}}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{{}}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{{b}}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{b\nc}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{a\\\nc}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{ b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{ b\n}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![ ]{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![ ]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![  ]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![\n]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![\\ ]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![\\\n]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![&Tab;]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![&a;]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="&amp;a;"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![[]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![a]{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![a\nb]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![a\\\nb]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{ttp://host}')), [['<img class="invalid" alt="ttp://host">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{tel:1234567890}')), [['<img class="invalid" alt="tel:1234567890">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{http://[::ffff:0:0%1]}')), [['<img class="invalid" alt="http://[::ffff:0:0%1]">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{http://[::ffff:0:0/96]}')), [['<img class="invalid" alt="http://[::ffff:0:0/96]">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{.}')), [['<img class="invalid" alt=".">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{..}')), [['<img class="invalid" alt="..">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{../}')), [['<img class="invalid" alt="../">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{/../b}')), [['<img class="invalid" alt="/../b">'], '']);
-      assert.deepStrictEqual(inspect(parser(' ![]{b}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[]{/}')), undefined);
+      assert.deepStrictEqual(inspect(parser(''), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('{}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('[]'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('!{}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{ }'), ctx), [['<span class="invalid">![]{ }</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{  }'), ctx), [['<span class="invalid">![]{  }</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{   }'), ctx), [['<span class="invalid">![]{   }</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]]{/}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{{}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{}}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{{}}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{{b}}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{b\nc}'), ctx), [['<span class="invalid">![]{b</span>'], '\nc}']);
+      assert.deepStrictEqual(inspect(parser('![]{b\\\nc}'), ctx), [['<span class="invalid">![]{b\\</span>'], '\nc}']);
+      assert.deepStrictEqual(inspect(parser('![]{ b}'), ctx), [['<span class="invalid">![]{ b}</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{ b\n}'), ctx), [['<span class="invalid">![]{ b</span>'], '\n}']);
+      assert.deepStrictEqual(inspect(parser('![ ]{}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![ ]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![  ]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![\n]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![\\ ]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![\\\n]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![&Tab;]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![&a;]{b}'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="&amp;a;"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![[]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![a]{}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![a\nb]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![a\\\nb]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{ttp://host}'), ctx), [['<img class="invalid" alt="ttp://host">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{tel:1234567890}'), ctx), [['<img class="invalid" alt="tel:1234567890">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{http://[::ffff:0:0%1]}'), ctx), [['<img class="invalid" alt="http://[::ffff:0:0%1]">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{http://[::ffff:0:0/96]}'), ctx), [['<img class="invalid" alt="http://[::ffff:0:0/96]">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{.}'), ctx), [['<img class="invalid" alt=".">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{..}'), ctx), [['<img class="invalid" alt="..">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{../}'), ctx), [['<img class="invalid" alt="../">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/../b}'), ctx), [['<img class="invalid" alt="/../b">'], '']);
+      assert.deepStrictEqual(inspect(parser(' ![]{b}'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('[]{/}'), ctx), undefined);
     });
 
     it('basic', () => {
-      assert.deepStrictEqual(inspect(parser('![]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{b }')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{b  }')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{ b }')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{ b  }')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{  b }')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{  b  }')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{  b   }')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{"}')), [['<a href="&quot;" target="_blank"><img class="media" data-src="&quot;" alt="&quot;"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{"}"}')), [['<a href="&quot;" target="_blank"><img class="media" data-src="&quot;" alt="&quot;"></a>'], '"}']);
-      assert.deepStrictEqual(inspect(parser('![]{\\}')), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt="\\"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{\\ }')), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt="\\"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{\\b}')), [['<a href="\\b" target="_blank"><img class="media" data-src="\\b" alt="\\b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{?/../}')), [[`<a href="?/../" target="_blank"><img class="media" data-src="?/../" alt="?/../"></a>`], '']);
-      assert.deepStrictEqual(inspect(parser('![]{#/../}')), [[`<a href="#/../" target="_blank"><img class="media" data-src="#/../" alt="#/../"></a>`], '']);
-      assert.deepStrictEqual(inspect(parser('![]{^/b}')), [[`<a href="/b" target="_blank"><img class="media" data-src="/b" alt="^/b"></a>`], '']);
-      assert.deepStrictEqual(inspect(parser('![ a]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![ a ]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![a ]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![a  ]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![a b]{c}')), [['<a href="c" target="_blank"><img class="media" data-src="c" alt="a b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![&copy;]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="©"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![&amp;copy;]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="&amp;copy;"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('!{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('!{ ][ }')), [['<a href="][" target="_blank"><img class="media" data-src="][" alt="]["></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('!{ }{ }')), [['<a href="}{" target="_blank"><img class="media" data-src="}{" alt="}{"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{b}'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{b }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{b  }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{ b }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{ b  }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{  b }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{  b  }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{  b   }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{"}'), ctx), [['<a href="&quot;" target="_blank"><img class="media" data-src="&quot;" alt="&quot;"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{"}"}'), ctx), [['<a href="&quot;" target="_blank"><img class="media" data-src="&quot;" alt="&quot;"></a>'], '"}']);
+      assert.deepStrictEqual(inspect(parser('![]{\\}'), ctx), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt="\\"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{\\ }'), ctx), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt="\\"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{\\b}'), ctx), [['<a href="\\b" target="_blank"><img class="media" data-src="\\b" alt="\\b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{?/../}'), ctx), [[`<a href="?/../" target="_blank"><img class="media" data-src="?/../" alt="?/../"></a>`], '']);
+      assert.deepStrictEqual(inspect(parser('![]{#/../}'), ctx), [[`<a href="#/../" target="_blank"><img class="media" data-src="#/../" alt="#/../"></a>`], '']);
+      assert.deepStrictEqual(inspect(parser('![]{^/b}'), ctx), [[`<a href="/b" target="_blank"><img class="media" data-src="/b" alt="^/b"></a>`], '']);
+      assert.deepStrictEqual(inspect(parser('![ a]{b}'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![ a ]{b}'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![a ]{b}'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![a  ]{b}'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![a b]{c}'), ctx), [['<a href="c" target="_blank"><img class="media" data-src="c" alt="a b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![&copy;]{b}'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="©"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![&amp;copy;]{b}'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="&amp;copy;"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('!{b}'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('!{ ][ }'), ctx), [['<a href="][" target="_blank"><img class="media" data-src="][" alt="]["></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('!{ }{ }'), ctx), [['<a href="}{" target="_blank"><img class="media" data-src="}{" alt="}{"></a>'], '']);
     });
 
     it('nest', () => {
-      assert.deepStrictEqual(inspect(parser('![\\[]{/}')), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="["></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![\\"]{"?"#"}')), [['<a href="&quot;?&quot;#&quot;" target="_blank"><img class="media" data-src="&quot;?&quot;#&quot;" alt="&quot;"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![*a*]{/}')), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="*a*"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![<wbr>]{/}')), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="&lt;wbr&gt;"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![\\[]{/}'), ctx), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="["></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![\\"]{"?"#"}'), ctx), [['<a href="&quot;?&quot;#&quot;" target="_blank"><img class="media" data-src="&quot;?&quot;#&quot;" alt="&quot;"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![*a*]{/}'), ctx), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="*a*"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![<wbr>]{/}'), ctx), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="&lt;wbr&gt;"></a>'], '']);
     });
 
     it('external', () => {
-      assert.deepStrictEqual(inspect(parser('![]{//host}')), [['<a href="//host" target="_blank"><img class="media" data-src="//host" alt="//host"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{//[::]}')), [['<a href="//[::]" target="_blank"><img class="media" data-src="//[::]" alt="//[::]"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{//host}'), ctx), [['<a href="//host" target="_blank"><img class="media" data-src="//host" alt="//host"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{//[::]}'), ctx), [['<a href="//[::]" target="_blank"><img class="media" data-src="//[::]" alt="//[::]"></a>'], '']);
     });
 
     it('attribute', () => {
-      assert.deepStrictEqual(inspect(parser('![]{/ __proto__}')), [['<a href="/" target="_blank"><img class="invalid" data-src="/" alt="/"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{/ constructor}')), [['<a href="/" target="_blank"><img class="invalid" data-src="/" alt="/"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{/ aspect-ratio}')), [['<a href="/" target="_blank"><img class="invalid" data-src="/" alt="/"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{/ nofollow}')), [['<a href="/" rel="nofollow" target="_blank"><img class="media" data-src="/" alt="/"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{/ width="4" height="3"}')), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="/" width="4" height="3"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{/ 4x3}')), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="/" width="4" height="3"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{/ aspect-ratio="4/3"}')), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="/" aspect-ratio="4/3" style="aspect-ratio: 4 / 3;"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{/ aspect-ratio="4/3" nofollow}')), [['<a href="/" rel="nofollow" target="_blank"><img class="media" data-src="/" alt="/" aspect-ratio="4/3" style="aspect-ratio: 4 / 3;"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{/ 4:3}')), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="/" aspect-ratio="4/3" style="aspect-ratio: 4 / 3;"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/ __proto__}'), ctx), [['<a href="/" target="_blank"><img class="invalid" data-src="/" alt="/"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/ constructor}'), ctx), [['<a href="/" target="_blank"><img class="invalid" data-src="/" alt="/"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/ aspect-ratio}'), ctx), [['<a href="/" target="_blank"><img class="invalid" data-src="/" alt="/"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/ nofollow}'), ctx), [['<a href="/" rel="nofollow" target="_blank"><img class="media" data-src="/" alt="/"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/ width="4" height="3"}'), ctx), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="/" width="4" height="3"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/ 4x3}'), ctx), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="/" width="4" height="3"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/ aspect-ratio="4/3"}'), ctx), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="/" aspect-ratio="4/3" style="aspect-ratio: 4 / 3;"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/ aspect-ratio="4/3" nofollow}'), ctx), [['<a href="/" rel="nofollow" target="_blank"><img class="media" data-src="/" alt="/" aspect-ratio="4/3" style="aspect-ratio: 4 / 3;"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/ 4:3}'), ctx), [['<a href="/" target="_blank"><img class="media" data-src="/" alt="/" aspect-ratio="4/3" style="aspect-ratio: 4 / 3;"></a>'], '']);
     });
 
   });

package/src/parser/inline/media.ts

@@ -1,12 +1,14 @@
 import { MediaParser } from '../inline';
-import { State, Recursion, Backtrack } from '../context';
-import { union, inits, tails, some, creation, recursion, precedence, constraint, validate, verify, surround, open, dup, lazy, fmap, bind } from '../../combinator';
+import { State, Recursion, Backtrack, Command } from '../context';
+import { subinput } from '../../combinator/data/parser';
+import { union, inits, tails, some, creation, recursion, precedence, constraint, validate, verify, surround, open, setBacktrack, dup, lazy, fmap, bind } from '../../combinator';
 import { unsafelink, uri, option as linkoption, resolve, decode } from './link';
 import { attributes } from './html';
 import { unsafehtmlentity } from './htmlentity';
 import { txt, linebreak, str } from '../source';
 import { invalid } from '../util';
 import { ReadonlyURL } from 'spica/url';
+import { unshift, push } from 'spica/array';
 import { html, define } from 'typed-dom/dom';
 
 const optspec = {
@@ -29,9 +31,9 @@ export const media: MediaParser = lazy(() => constraint(State.media, validate(['
       ]), ']')),
       ']',
       true,
-      ([, ns = []], rest, context) =>
+      ([, ns = []], context) =>
         context.linebreak === 0
-          ? [ns, rest]
+          ? [ns]
           : undefined,
       undefined,
       [3 | Backtrack.escbracket])),
@@ -39,12 +41,30 @@ export const media: MediaParser = lazy(() => constraint(State.media, validate(['
       /^{(?![{}])/,
       inits([uri, some(option)]),
       /^[^\S\n]*}/,
-      false, undefined, undefined,
+      false,
+      undefined,
+      ([as, bs], context) => {
+        if (!bs) return;
+        const head = context.position - context.range!;
+        setBacktrack(context, [2 | Backtrack.link], head);
+        return [push(unshift(as, bs), [Command.Cancel])];
+      },
       [3 | Backtrack.link])),
   ]),
   ([as, bs]) => bs ? [[as.join('').trim() || as.join('')], bs] : [[''], as]),
   ([[text]]) => text === '' || text.trim() !== ''),
-  ([[text], params], rest, context) => {
+  ([[text], params], context) => {
+    if (params.at(-1) === Command.Cancel) {
+      params.pop();
+      return [[
+        html('span',
+          {
+            class: 'invalid',
+            ...invalid('media', 'syntax', 'Missing the closing symbol "}"')
+          },
+          '!' + context.source.slice(context.position - context.range!, context.position))
+      ]];
+    }
     assert(text === text.trim());
     const INSECURE_URI = params.shift()!;
     assert(INSECURE_URI === INSECURE_URI.trim());
@@ -65,7 +85,7 @@ export const media: MediaParser = lazy(() => constraint(State.media, validate(['
       || html('img', { class: 'media', 'data-src': uri?.source });
     assert(!el.matches('.invalid'));
     el.setAttribute('alt', text);
-    if (!sanitize(el, uri)) return [[el], rest];
+    if (!sanitize(el, uri)) return [[el]];
     assert(!el.matches('.invalid'));
     define(el, attributes('media', optspec, params));
     assert(el.matches('img') || !el.matches('.invalid'));
@@ -73,12 +93,17 @@ export const media: MediaParser = lazy(() => constraint(State.media, validate(['
     if (el.hasAttribute('aspect-ratio')) {
       el.style.aspectRatio = el.getAttribute('aspect-ratio')!;
     }
-    if (context.state! & State.link) return [[el], rest];
-    if (cache && cache.tagName !== 'IMG') return [[el], rest];
+    if (context.state! & State.link) return [[el]];
+    if (cache && cache.tagName !== 'IMG') return [[el]];
+    const { source, position } = context;
     return fmap(
       unsafelink as MediaParser,
-      ([link]) => [define(link, { class: null, target: '_blank' }, [el])])
-      ({ source: `{ ${INSECURE_URI}${params.join('')} }${rest}`, context });
+      ([link]) => {
+        context.source = source;
+        context.position = position;
+        return [define(link, { class: null, target: '_blank' }, [el])];
+      })
+      (subinput(`{ ${INSECURE_URI}${params.join('')} }`, context));
   }))))));
 
 export const linemedia: MediaParser.LineMediaParser = surround(
@@ -88,13 +113,13 @@ export const linemedia: MediaParser.LineMediaParser = surround(
 
 const bracket: MediaParser.TextParser.BracketParser = lazy(() => recursion(Recursion.terminal, union([
   surround(str('('), some(union([unsafehtmlentity, bracket, txt]), ')'), str(')'), true,
-    undefined, () => [[], ''], [3 | Backtrack.escbracket]),
+    undefined, () => [[]], [3 | Backtrack.escbracket]),
   surround(str('['), some(union([unsafehtmlentity, bracket, txt]), ']'), str(']'), true,
-    undefined, () => [[], ''], [3 | Backtrack.escbracket]),
+    undefined, () => [[]], [3 | Backtrack.escbracket]),
   surround(str('{'), some(union([unsafehtmlentity, bracket, txt]), '}'), str('}'), true,
-    undefined, () => [[], ''], [3 | Backtrack.escbracket]),
+    undefined, () => [[]], [3 | Backtrack.escbracket]),
   surround(str('"'), precedence(2, some(union([unsafehtmlentity, txt]), '"')), str('"'), true,
-    undefined, () => [[], ''], [3 | Backtrack.escbracket]),
+    undefined, () => [[]], [3 | Backtrack.escbracket]),
 ])));
 
 const option: MediaParser.ParameterParser.OptionParser = lazy(() => union([
@@ -103,11 +128,10 @@ const option: MediaParser.ParameterParser.OptionParser = lazy(() => union([
     str(/^[x:]/),
     str(/^[1-9][0-9]*(?=[^\S\n]|})/),
     false,
-    ([[a], [b], [c]], rest) => [
+    ([[a], [b], [c]]) => [
       b === 'x'
         ? [`width="${a}"`, `height="${c}"`]
         : [`aspect-ratio="${a}/${c}"`],
-      rest
     ]),
   linkoption,
 ]));