securemark 0.293.2 → 0.293.4

package/src/parser/inline/html.test.ts

@@ -67,7 +67,7 @@ describe('Unit: parser/inline/html', () => {
       assert.deepStrictEqual(inspect(parser('<wbr >'), ctx), [['<wbr>'], '']);
       assert.deepStrictEqual(inspect(parser('<wbr>a'), ctx), [['<wbr>'], 'a']);
       assert.deepStrictEqual(inspect(parser('<bdi >a</bdi>'), ctx), [['<bdi>a</bdi>'], '']);
-      assert.deepStrictEqual(inspect(parser('<bdi  >a</bdi>'), ctx), [['<bdi>a</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi  >a</bdi>'), ctx), [['<span class="invalid">&lt;bdi  &gt;a&lt;/bdi&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi> a</bdi>'), ctx), [['<bdi> a</bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi> a </bdi>'), ctx), [['<bdi> a </bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi>  a  </bdi>'), ctx), [['<bdi> a </bdi>'], '']);
@@ -122,8 +122,8 @@ describe('Unit: parser/inline/html', () => {
       assert.deepStrictEqual(inspect(parser('<bdo diR="rtl">a</bdo>'), ctx), [['<span class="invalid">&lt;bdo diR="rtl"&gt;a&lt;/bdo&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdo dir="rtl">a</bdo>'), ctx), [['<bdo dir="rtl">a</bdo>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdo dir="rtl" >a</bdo>'), ctx), [['<bdo dir="rtl">a</bdo>'], '']);
-      assert.deepStrictEqual(inspect(parser('<bdo dir="rtl"  >a</bdo>'), ctx), [['<bdo dir="rtl">a</bdo>'], '']);
-      assert.deepStrictEqual(inspect(parser('<bdo  dir="rtl">a</bdo>'), ctx), [['<bdo dir="rtl">a</bdo>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdo dir="rtl"  >a</bdo>'), ctx), [['<span class="invalid">&lt;bdo dir="rtl"  &gt;a&lt;/bdo&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdo  dir="rtl">a</bdo>'), ctx), [['<span class="invalid">&lt;bdo  dir="rtl"&gt;a&lt;/bdo&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<wbr\n>'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('<wbr \n>'), ctx), [['<span class="invalid">&lt;wbr </span>'], '\n>']);
       assert.deepStrictEqual(inspect(parser('<wbr constructor>'), ctx), [['<span class="invalid">&lt;wbr constructor&gt;</span>'], '']);

package/src/parser/inline/html.ts

@@ -7,7 +7,7 @@ import { str } from '../source';
 import { isLooseNodeStart, blankWith } from '../visibility';
 import { invalid } from '../util';
 import { memoize } from 'spica/memoize';
-import { unshift, push, splice } from 'spica/array';
+import { unshift, push } from 'spica/array';
 import { html as h, defrag } from 'typed-dom/dom';
 
 const tags: readonly string[] = ['wbr', 'bdo', 'bdi'];
@@ -20,13 +20,13 @@ const attrspecs = {
 Object.setPrototypeOf(attrspecs, null);
 Object.values(attrspecs).forEach(o => Object.setPrototypeOf(o, null));
 
-export const html: HTMLParser = lazy(() => validate(/<[a-z]+(?=[^\S\n]|>)/yi,
+export const html: HTMLParser = lazy(() => validate(/<[a-z]+(?=[ >])/yi,
   union([
     surround(
       // https://html.spec.whatwg.org/multipage/syntax.html#void-elements
-      str(/<(?:area|base|br|col|embed|hr|img|input|link|meta|source|track|wbr)(?=[^\S\n]|>)/yi),
+      str(/<(?:area|base|br|col|embed|hr|img|input|link|meta|source|track|wbr)(?=[ >])/yi),
       some(union([attribute])),
-      open(str(/[^\S\n]*/y), str('>'), true),
+      open(str(/ ?/y), str('>'), true),
       true,
       ([as, bs = [], cs], context) =>
         [[elem(as[0].slice(1), false, push(unshift(as, bs), cs), [], [], context)]],
@@ -38,14 +38,18 @@ export const html: HTMLParser = lazy(() => validate(/<[a-z]+(?=[^\S\n]|>)/yi,
       ([, tag]) =>
         surround<HTMLParser.TagParser, string>(
           surround(
-            str(`<${tag}`), some(attribute), open(str(/[^\S\n]*/y), str('>'), true),
+            str(`<${tag}`), some(attribute), open(str(/ ?/y), str('>'), true),
             true,
             ([as, bs = [], cs]) => [push(unshift(as, bs), cs)],
             ([as, bs = []]) => [unshift(as, bs)]),
-          precedence(3, recursion(Recursion.inline,
+          // 不可視のHTML構造が可視構造を変化させるべきでない。
+          // 可視のHTMLは優先度変更を検討する。
+          // このため<>は将来的に共通構造を変化させる可能性があり
+          // 共通構造を変化させない非構造文字列としては依然としてエスケープを要する。
+          precedence(0, recursion(Recursion.inline,
           some(union([
-            some(inline, blankWith('\n', `</${tag}>`), [[blankWith('\n', `</${tag}>`), 3]]),
-            open('\n', some(inline, `</${tag}>`, [[`</${tag}>`, 3]]), true),
+            some(inline, blankWith('\n', `</${tag}>`)),
+            open('\n', some(inline, `</${tag}>`), true),
           ])))),
           str(`</${tag}>`),
           true,
@@ -57,9 +61,9 @@ export const html: HTMLParser = lazy(() => validate(/<[a-z]+(?=[^\S\n]|>)/yi,
       new Map())),
     surround(
       // https://html.spec.whatwg.org/multipage/syntax.html#void-elements
-      str(/<[a-z]+(?=[^\S\n]|>)/yi),
+      str(/<[a-z]+(?=[ >])/yi),
       some(union([attribute])),
-      open(str(/[^\S\n]*/y), str('>'), true),
+      open(str(/ ?/y), str('>'), true),
       true,
       ([as, bs = [], cs], context) =>
         [[elem(as[0].slice(1), false, push(unshift(as, bs), cs), [], [], context)]],
@@ -68,8 +72,8 @@ export const html: HTMLParser = lazy(() => validate(/<[a-z]+(?=[^\S\n]|>)/yi,
   ])));
 
 export const attribute: HTMLParser.AttributeParser = union([
-  str(/[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|>)/yi),
-  str(/[^\S\n]+[^\s<>]+/y),
+  str(/ [a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[ >])/yi),
+  str(/ [^\s<>]+/y),
 ]);
 
 function elem(tag: string, content: boolean, as: string[], bs: (HTMLElement | string)[], cs: string[], context: Ctx): HTMLElement {
@@ -81,7 +85,7 @@ function elem(tag: string, content: boolean, as: string[], bs: (HTMLElement | st
     if (bs.length === 0) return ielem('content', `Missing the content`, context);
     if (!isLooseNodeStart(bs)) return ielem('content', `Missing the visible content in the same line`, context);
   }
-  const attrs = attributes('html', attrspecs[tag], as.slice(1, as.at(-1) === '>' ? -1 : as.length));
+  const [attrs] = attributes('html', attrspecs[tag], as.slice(1, as.at(-1) === '>' ? -1 : as.length));
   if (/(?<!\S)invalid(?!\S)/.test(attrs['class'] ?? '')) return ielem('attribute', 'Invalid HTML attribute', context)
   if (as.at(-1) !== '>') return ielem('tag', `Missing the closing symbol ">"`, context);
   return h(tag as 'span', attrs, defrag(bs));
@@ -101,11 +105,12 @@ const requiredAttributes = memoize(
 export function attributes(
   syntax: string,
   spec: Readonly<Record<string, readonly (string | undefined)[] | undefined>> | undefined,
-  params: string[],
-): Record<string, string | undefined> {
+  params: readonly string[],
+): [Record<string, string | undefined>, string[]] {
   assert(spec instanceof Object === false);
   assert(!spec?.['__proto__']);
   assert(!spec?.toString);
+  const remains = [];
   let invalidation = false;
   const attrs: Record<string, string | undefined> = {};
   for (let i = 0; i < params.length; ++i) {
@@ -116,19 +121,25 @@ export function attributes(
       ? param.slice(name.length + 2, -1).replace(/\\(.?)/g, '$1')
       : undefined;
     invalidation ||= name === '' || !spec || name in attrs;
-    if (name === '' || spec && name in spec && !spec[name]) continue;
-    spec?.[name]?.includes(value) || spec?.[name]?.length === 0 && value !== undefined
-      ? attrs[name] = value ?? ''
-      : invalidation ||= !!spec;
+    if (name === '')continue;
+    if (spec && name in spec && !spec[name]) {
+      remains.push(params[i]);
+      continue;
+    }
+    if (spec?.[name]?.includes(value) || spec?.[name]?.length === 0 && value !== undefined) {
+      attrs[name] = value ?? ''
+    }
+    else {
+      invalidation ||= !!spec;
+    }
     assert(!(name in {} && attrs.hasOwnProperty(name)));
-    splice(params, i--, 1);
   }
   invalidation ||= !!spec && !requiredAttributes(spec).every(name => name in attrs);
   if (invalidation) {
     attrs['class'] = 'invalid';
     Object.assign(attrs, invalid(syntax, 'argument', 'Invalid argument'));
   }
-  return attrs;
+  return [attrs, remains];
 }
 
 // https://developer.mozilla.org/en-US/docs/Web/HTML/Element

package/src/parser/inline/italic.test.ts

@@ -58,6 +58,7 @@ describe('Unit: parser/inline/italic', () => {
       assert.deepStrictEqual(inspect(parser('//////a//////'), ctx), [['<i><i>a</i></i>'], '']);
       assert.deepStrictEqual(inspect(parser('//////a///b///'), ctx), [['<i><i>a</i>b</i>'], '']);
       assert.deepStrictEqual(inspect(parser('///a ///b//////'), ctx), [['<i>a <i>b</i></i>'], '']);
+      assert.deepStrictEqual(inspect(parser('///- ///b//////'), ctx), [['<i>- <i>b</i></i>'], '']);
       assert.deepStrictEqual(inspect(parser('///a\\ ///b//////'), ctx), [['<i>a <i>b</i></i>'], '']);
       assert.deepStrictEqual(inspect(parser('///a //////b/////////'), ctx), [['<i>a <i><i>b</i></i></i>'], '']);
       assert.deepStrictEqual(inspect(parser('///a ///b///c///'), ctx), [['<i>a <i>b</i>c</i>'], '']);

package/src/parser/inline/link.test.ts

@@ -63,8 +63,8 @@ describe('Unit: parser/inline/link', () => {
       assert.deepStrictEqual(inspect(parser('[]'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[]{}'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[]{ }'), ctx), [['<span class="invalid">[]{ }</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{  }'), ctx), [['<span class="invalid">[]{  }</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{   }'), ctx), [['<span class="invalid">[]{   }</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('[]{  }'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('[]{   }'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[]{{}'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[]{}}'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[]{{}}'), ctx), undefined);
@@ -105,12 +105,11 @@ describe('Unit: parser/inline/link', () => {
     it('basic', () => {
       assert.deepStrictEqual(inspect(parser('[]{b}'), ctx), [['<a class="url" href="b">b</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{b }'), ctx), [['<a class="url" href="b">b</a>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{b  }'), ctx), [['<a class="url" href="b">b</a>'], '']);
+      assert.deepStrictEqual(inspect(parser('[]{b  }'), ctx), [['<span class="invalid">[]{b</span>'], '  }']);
       assert.deepStrictEqual(inspect(parser('[]{ b }'), ctx), [['<a class="url" href="b">b</a>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{ b  }'), ctx), [['<a class="url" href="b">b</a>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{  b }'), ctx), [['<a class="url" href="b">b</a>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{  b  }'), ctx), [['<a class="url" href="b">b</a>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{  b   }'), ctx), [['<a class="url" href="b">b</a>'], '']);
+      assert.deepStrictEqual(inspect(parser('[]{ b  }'), ctx), [['<span class="invalid">[]{ b</span>'], '  }']);
+      assert.deepStrictEqual(inspect(parser('[]{  b }'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('[]{  b  }'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[]{"}'), ctx), [[`<a class="url" href="&quot;">"</a>`], '']);
       assert.deepStrictEqual(inspect(parser('[]{"}"}'), ctx), [[`<a class="url" href="&quot;">"</a>`], '"}']);
       assert.deepStrictEqual(inspect(parser('[]{\\}'), ctx), [[`<a class="url" href="\\">\\</a>`], '']);
@@ -209,7 +208,6 @@ describe('Unit: parser/inline/link', () => {
       assert.deepStrictEqual(inspect(parser('[]{/ aspect-ratio="4/3"}'), ctx), [['<a class="invalid" href="/">/</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{/ 4:3}'), ctx), [['<a class="invalid" href="/">/</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{/ =}'), ctx), [['<a class="invalid" href="/">/</a>'], '']);
-      assert.deepStrictEqual(inspect(parser('[]{/  name}'), ctx), [['<a class="invalid" href="/">/</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{/\nname}'), ctx), [['<span class="invalid">[]{/</span>'], '\nname}']);
     });
 
@@ -221,8 +219,12 @@ describe('Unit: parser/inline/link', () => {
       assert.deepStrictEqual(inspect(parser('[]{/ nofollow nofollow}'), ctx), [['<a class="invalid" href="/" rel="nofollow">/</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{/ nofollow}'), ctx), [['<a class="url" href="/" rel="nofollow">/</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{/ nofollow }'), ctx), [['<a class="url" href="/" rel="nofollow">/</a>'], '']);
+      assert.deepStrictEqual(inspect(parser('[]{/ nofollow  }'), ctx), [['<span class="invalid">[]{/ nofollow</span>'], '  }']);
+      assert.deepStrictEqual(inspect(parser('[]{/  nofollow}'), ctx), [['<span class="invalid">[]{/</span>'], '  nofollow}']);
       assert.deepStrictEqual(inspect(parser('[]{ / nofollow}'), ctx), [['<a class="url" href="/" rel="nofollow">/</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{ / nofollow }'), ctx), [['<a class="url" href="/" rel="nofollow">/</a>'], '']);
+      assert.deepStrictEqual(inspect(parser('[]{ / nofollow  }'), ctx), [['<span class="invalid">[]{ / nofollow</span>'], '  }']);
+      assert.deepStrictEqual(inspect(parser('[]{ /  nofollow}'), ctx), [['<span class="invalid">[]{ /</span>'], '  nofollow}']);
       assert.deepStrictEqual(inspect(parser('[]{http://host nofollow}'), ctx), [['<a class="url" href="http://host" target="_blank" rel="nofollow">http://host</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[!http://host]{http://host nofollow}'), ctx), [['<a class="link" href="http://host" target="_blank" rel="nofollow"><img class="media" data-src="http://host" alt="http://host"></a>'], '']);
     });

package/src/parser/inline/link.ts

@@ -35,7 +35,7 @@ export const textlink: LinkParser.TextLinkParser = lazy(() => constraint(State.l
     dup(surround(
       /{(?![{}])/y,
       inits([uri, some(option)]),
-      /[^\S\n]*}/y,
+      / ?}/y,
       false,
       undefined,
       ([as, bs], context) => {
@@ -82,7 +82,7 @@ export const medialink: LinkParser.MediaLinkParser = lazy(() => constraint(State
       '[',
       union([media, shortmedia]),
       ']')),
-    dup(surround(/{(?![{}])/y, inits([uri, some(option)]), /[^\S\n]*}/y)),
+    dup(surround(/{(?![{}])/y, inits([uri, some(option)]), / ?}/y)),
   ])),
   ([params, content = []]: [string[], (HTMLElement | string)[]], context) =>
     [[parse(defrag(content), params, context)]]))))));
@@ -94,20 +94,20 @@ export const unsafelink: LinkParser.UnsafeLinkParser = lazy(() =>
       '[',
       some(union([unescsource]), ']'),
       ']')),
-    dup(surround(/{(?![{}])/y, inits([uri, some(option)]), /[^\S\n]*}/y)),
+    dup(surround(/{(?![{}])/y, inits([uri, some(option)]), / ?}/y)),
   ])),
   ([params, content = []], context) =>
     [[parse(defrag(content), params, context)]])));
 
 export const uri: LinkParser.ParameterParser.UriParser = union([
-  open(/[^\S\n]+/y, str(/\S+/y)),
+  open(/ /y, str(/\S+/y)),
   str(/[^\s{}]+/y),
 ]);
 
 export const option: LinkParser.ParameterParser.OptionParser = union([
-  fmap(str(/[^\S\n]+nofollow(?=[^\S\n]|})/y), () => [` rel="nofollow"`]),
-  str(/[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|})/yi),
-  str(/[^\S\n]+[^\s{}]+/y),
+  fmap(str(/ nofollow(?=[ }])/y), () => [` rel="nofollow"`]),
+  str(/ [a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[ }])/yi),
+  str(/ [^\s{}]+/y),
 ]);
 
 function parse(
@@ -135,7 +135,7 @@ function parse(
     context.host?.origin || location.origin);
   return el.classList.contains('invalid')
     ? el
-    : define(el, attributes('link', optspec, params));
+    : define(el, attributes('link', optspec, params)[0]);
 }
 
 function elem(
@@ -155,11 +155,11 @@ function elem(
     case 'https:':
       assert(uri.host);
       switch (true) {
-        case /[a-z][0-9]*:\/{0,2}\S/i.test(stringify(content)):
+        case /[0-9a-z]:\S/i.test(stringify(content)):
           type = 'content';
           message = 'URI must not be contained';
           break;
-        case INSECURE_URI.slice(0, 2) === '^/'
+        case INSECURE_URI.startsWith('^/')
           && /\/\.\.?(?:\/|$)/.test(INSECURE_URI.slice(0, INSECURE_URI.search(/[?#]|$/))):
           type = 'argument';
           message = 'Dot-segments cannot be used in subresource paths';
@@ -223,7 +223,7 @@ export function resolve(uri: string, host: URL | Location, source: URL | Locatio
   assert(uri);
   assert(uri === uri.trim());
   switch (true) {
-    case uri.slice(0, 2) === '^/':
+    case uri.startsWith('^/'):
       const last = host.pathname.slice(host.pathname.lastIndexOf('/') + 1);
       return last.includes('.') // isFile
           // Exclude ISO 6709.
@@ -232,7 +232,7 @@ export function resolve(uri: string, host: URL | Location, source: URL | Locatio
         : `${host.pathname.replace(/\/?$/, '/')}${uri.slice(2)}`;
     case host.origin === source.origin
       && host.pathname === source.pathname:
-    case uri.slice(0, 2) === '//':
+    case uri.startsWith('//'):
       return uri;
     default:
       const target = new ReadonlyURL(uri, source.href);
@@ -243,13 +243,13 @@ export function resolve(uri: string, host: URL | Location, source: URL | Locatio
 }
 
 export function decode(uri: string): string {
-  const origin = uri.match(/[a-z](?:[-.](?=[0-9a-z])|[0-9a-z])*:(?:\/{0,2}[^/?#\s]+|\/\/(?=[/]))/yi)?.[0] ?? '';
+  const head = /^[a-z]+(?:[.+-][0-9a-z]+)*:\/*[^/?#\s]+/i;
+  const origin = uri.match(head)?.[0] ?? '';
   try {
-    let path = decodeURI(uri.slice(origin.length));
-    if (!origin && /[a-z](?:[-.](?=[0-9a-z])|[0-9a-z])*:\/{0,2}\S/yi.test(path)) {
-      path = uri.slice(origin.length);
-    }
-    uri = origin + path;
+    const path = decodeURI(uri.slice(origin.length));
+    uri = !origin && head.test(path)
+      ? uri.slice(origin.length)
+      : origin + path;
   }
   finally {
     return uri.replace(/\s+/g, encodeURI);

package/src/parser/inline/mark.test.ts

@@ -39,6 +39,7 @@ describe('Unit: parser/inline/mark', () => {
 
     it('nest', () => {
       assert.deepStrictEqual(inspect(parser('==a ==b===='), ctx), [['<mark id="mark::a_b">a <mark id="mark::b">b</mark><a href="#mark::b"></a></mark>', '<a href="#mark::a_b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('==- ==b===='), ctx), [['<mark id="mark::-_b">- <mark id="mark::b">b</mark><a href="#mark::b"></a></mark>', '<a href="#mark::-_b"></a>'], '']);
       assert.deepStrictEqual(inspect(parser('==a\\ ==b===='), ctx), [['<mark id="mark::a_b">a <mark id="mark::b">b</mark><a href="#mark::b"></a></mark>', '<a href="#mark::a_b"></a>'], '']);
       assert.deepStrictEqual(inspect(parser('==a&Tab;==b===='), ctx), [['<mark id="mark::a_b=33Mw2l">a\t<mark id="mark::b">b</mark><a href="#mark::b"></a></mark>', '<a href="#mark::a_b=33Mw2l"></a>'], '']);
       assert.deepStrictEqual(inspect(parser('==a<wbr>==b===='), ctx), [['<mark id="mark::ab">a<wbr><mark id="mark::b">b</mark><a href="#mark::b"></a></mark>', '<a href="#mark::ab"></a>'], '']);

package/src/parser/inline/math.ts

@@ -11,14 +11,14 @@ export const math: MathParser = lazy(() => rewrite(
   union([
     surround(
       /\$(?={)/y,
-      precedence(5, bracket),
+      precedence(4, bracket),
       '$',
       false, undefined, undefined, [3 | Backtrack.bracket]),
     surround(
       /\$(?![\s{}])/y,
       precedence(2, some(union([
         some(escsource, /\s?\$|[`"{}\n]/y),
-        precedence(5, bracket),
+        precedence(4, bracket),
       ]))),
       /\$(?![-0-9A-Za-z])/y,
       false, undefined, undefined, [3 | Backtrack.bracket]),

package/src/parser/inline/media.test.ts

@@ -27,8 +27,8 @@ describe('Unit: parser/inline/media', () => {
       assert.deepStrictEqual(inspect(parser('![]'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('![]{}'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('![]{ }'), ctx), [['<span class="invalid">![]{ }</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{  }'), ctx), [['<span class="invalid">![]{  }</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{   }'), ctx), [['<span class="invalid">![]{   }</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{  }'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{   }'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('![]]{/}'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('![]{{}'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('![]{}}'), ctx), undefined);
@@ -66,12 +66,11 @@ describe('Unit: parser/inline/media', () => {
     it('basic', () => {
       assert.deepStrictEqual(inspect(parser('![]{b}'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![]{b }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{b  }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{b  }'), ctx), [['<span class="invalid">![]{b</span>'], '  }']);
       assert.deepStrictEqual(inspect(parser('![]{ b }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{ b  }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{  b }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{  b  }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{  b   }'), ctx), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="b"></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{ b  }'), ctx), [['<span class="invalid">![]{ b</span>'], '  }']);
+      assert.deepStrictEqual(inspect(parser('![]{  b }'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{  b  }'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('![]{"}'), ctx), [['<a href="&quot;" target="_blank"><img class="media" data-src="&quot;" alt="&quot;"></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![]{"}"}'), ctx), [['<a href="&quot;" target="_blank"><img class="media" data-src="&quot;" alt="&quot;"></a>'], '"}']);
       assert.deepStrictEqual(inspect(parser('![]{\\}'), ctx), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt="\\"></a>'], '']);

package/src/parser/inline/media.ts

@@ -40,7 +40,7 @@ export const media: MediaParser = lazy(() => constraint(State.media, creation(10
     dup(surround(
       /{(?![{}])/y,
       inits([uri, some(option)]),
-      /[^\S\n]*}/y,
+      / ?}/y,
       false,
       undefined,
       ([as, bs], context) => {
@@ -87,7 +87,8 @@ export const media: MediaParser = lazy(() => constraint(State.media, creation(10
     el.setAttribute('alt', text);
     if (!sanitize(el, uri)) return [[el]];
     assert(!el.matches('.invalid'));
-    define(el, attributes('media', optspec, params));
+    const [attrs, linkparams] = attributes('media', optspec, params);
+    define(el, attrs);
     assert(el.matches('img') || !el.matches('.invalid'));
     // Awaiting the generic support for attr().
     if (el.hasAttribute('aspect-ratio')) {
@@ -103,7 +104,7 @@ export const media: MediaParser = lazy(() => constraint(State.media, creation(10
         context.position = position;
         return [define(link, { class: null, target: '_blank' }, [el])];
       })
-      (subinput(`{ ${INSECURE_URI}${params.join('')} }`, context));
+      (subinput(`{ ${INSECURE_URI}${linkparams.join('')} }`, context));
   })))));
 
 const bracket: MediaParser.TextParser.BracketParser = lazy(() => recursion(Recursion.terminal, union([
@@ -119,9 +120,9 @@ const bracket: MediaParser.TextParser.BracketParser = lazy(() => recursion(Recur
 
 const option: MediaParser.ParameterParser.OptionParser = lazy(() => union([
   surround(
-    open(/[^\S\n]+/y, str(/[1-9][0-9]*/y)),
+    open(/ /y, str(/[1-9][0-9]*/y)),
     str(/[x:]/y),
-    str(/[1-9][0-9]*(?=[^\S\n]|})/y),
+    str(/[1-9][0-9]*(?=[ }])/y),
     false,
     ([[a], [b], [c]]) => [
       b === 'x'

package/src/parser/inline/reference.test.ts

@@ -17,7 +17,7 @@ describe('Unit: parser/inline/reference', () => {
       assert.deepStrictEqual(inspect(parser('[[]]]'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[["]]'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[[(]]'), ctx), undefined);
-      assert.deepStrictEqual(inspect(parser('[[<bdi>]]'), ctx), undefined);
+      assert.deepStrictEqual(inspect(parser('[[[%]]'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[[ ]]'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[[ [a'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[[\n]]'), ctx), undefined);

package/src/parser/inline/remark.test.ts

@@ -31,7 +31,7 @@ describe('Unit: parser/inline/remark', () => {
       assert.deepStrictEqual(inspect(parser('[%\\ a %]'), ctx), undefined);
       assert.deepStrictEqual(inspect(parser('[% a\\ %]'), ctx), [['[%', ' a', ' ', '%', ']'], '']);
       assert.deepStrictEqual(inspect(parser('[% a%]'), ctx), [['[%', ' a', '%', ']'], '']);
-      assert.deepStrictEqual(inspect(parser('[% a %%]'), ctx), [['[%', ' a', ' ', '%', '%', ']'], '']);
+      assert.deepStrictEqual(inspect(parser('[% a %%]'), ctx), [['[%', ' a %', '%', ']'], '']);
       assert.deepStrictEqual(inspect(parser('[% [%% %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% <span class="invalid">[%%</span> %]</span></span>'], '']);
       assert.deepStrictEqual(inspect(parser('[%% [% %%]'), ctx), [['<span class="invalid">[%%</span>'], ' [% %%]']);
       assert.deepStrictEqual(inspect(parser('[%% a %]'), ctx), [['<span class="invalid">[%%</span>'], ' a %]']);
@@ -43,7 +43,9 @@ describe('Unit: parser/inline/remark', () => {
       assert.deepStrictEqual(inspect(parser('[%  %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% %]</span></span>'], '']);
       assert.deepStrictEqual(inspect(parser('[%   %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% %]</span></span>'], '']);
       assert.deepStrictEqual(inspect(parser('[% a %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% a %]</span></span>'], '']);
+      assert.deepStrictEqual(inspect(parser('[% - %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% - %]</span></span>'], '']);
       assert.deepStrictEqual(inspect(parser('[%  a  %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% a %]</span></span>'], '']);
+      assert.deepStrictEqual(inspect(parser('[%  -  %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% - %]</span></span>'], '']);
       assert.deepStrictEqual(inspect(parser('[% a b %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% a b %]</span></span>'], '']);
       assert.deepStrictEqual(inspect(parser('[% a\nb %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% a<br>b %]</span></span>'], '']);
       assert.deepStrictEqual(inspect(parser('[% a %] %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% a %]</span></span>'], ' %]']);

package/src/parser/inline/remark.ts

@@ -9,8 +9,8 @@ import { html, defrag } from 'typed-dom/dom';
 
 export const remark: RemarkParser = lazy(() => fallback(surround(
   str(/\[%(?=\s)/y),
-  precedence(4, recursion(Recursion.inline,
-  some(union([inline]), /\s%\]/y, [[/\s%\]/y, 4]]))),
+  precedence(3, recursion(Recursion.inline,
+  some(union([inline]), /\s%\]/y, [[/\s%\]/y, 3]]))),
   close(text, str(`%]`)), true,
   ([as, bs = [], cs]) => [[
     html('span', { class: 'remark' }, [

package/src/parser/inline/strong.test.ts

@@ -39,6 +39,7 @@ describe('Unit: parser/inline/strong', () => {
 
     it('nest', () => {
       assert.deepStrictEqual(inspect(parser('**a *b***'), ctx), [['<strong>a <em>b</em></strong>'], '']);
+      assert.deepStrictEqual(inspect(parser('**- *b***'), ctx), [['<strong>- <em>b</em></strong>'], '']);
       assert.deepStrictEqual(inspect(parser('**a **b****'), ctx), [['<strong>a <strong>b</strong></strong>'], '']);
       assert.deepStrictEqual(inspect(parser('**a&Tab;**b****'), ctx), [['<strong>a\t<strong>b</strong></strong>'], '']);
       assert.deepStrictEqual(inspect(parser('**a<wbr>**b****'), ctx), [['<strong>a<wbr><strong>b</strong></strong>'], '']);

package/src/parser/inline/template.ts

@@ -34,7 +34,7 @@ const bracket: TemplateParser.BracketParser = lazy(() => union([
     undefined, () => [[]], [3 | Backtrack.escbracket]),
   surround(
     str('"'),
-    precedence(2, recursion(Recursion.terminal, some(escsource, '"', [['"', 2, false]]))),
+    precedence(2, recursion(Recursion.terminal, some(escsource, /["\n]/y, [['"', 2], ['\n', 3]]))),
     str('"'),
     true,
     ([as, bs = [], cs], context) =>

package/src/parser/inline.test.ts

@@ -22,7 +22,7 @@ describe('Unit: parser/inline', () => {
     it('nest', () => {
       assert.deepStrictEqual(inspect(parser('あ（Ａ）'), ctx), [['あ', '（', 'Ａ', '）'], '']);
       assert.deepStrictEqual(inspect(parser('あ（い）'), ctx), [['あ', '<span class="paren">（い）</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('* a*'), ctx), [['*', ' a', '*'], '']);
+      assert.deepStrictEqual(inspect(parser('* a*'), ctx), [['* a', '*'], '']);
       assert.deepStrictEqual(inspect(parser('** a**'), ctx), [['**', ' a', '**'], '']);
       assert.deepStrictEqual(inspect(parser('*** a***'), ctx), [['***', ' a', '***'], '']);
       assert.deepStrictEqual(inspect(parser('**** a****'), ctx), [['****', ' a', '****'], '']);
@@ -82,19 +82,19 @@ describe('Unit: parser/inline', () => {
       assert.deepStrictEqual(inspect(parser('*++ a ++*'), ctx), [['<em><ins> a </ins></em>'], '']);
       assert.deepStrictEqual(inspect(parser('*++  a  ++*'), ctx), [['<em><ins> a </ins></em>'], '']);
       assert.deepStrictEqual(inspect(parser('*<bdi>`a`</bdi>*'), ctx), [['<em><bdi><code data-src="`a`">a</code></bdi></em>'], '']);
-      assert.deepStrictEqual(inspect(parser('*a"\nb*'), ctx), [['*', 'a', '"', '<br>', 'b', '*'], '']);
+      assert.deepStrictEqual(inspect(parser('*a"\nb*'), ctx), [['<em>a"<br>b</em>'], '']);
       assert.deepStrictEqual(inspect(parser('*a"\n"("b*'), ctx), [['<em>a"<br>"("b</em>'], '']);
-      assert.deepStrictEqual(inspect(parser('"*a\nb*'), ctx), [['"', '<em>a<br>b</em>'], '']);
-      assert.deepStrictEqual(inspect(parser('"*a\n""b*'), ctx), [['"', '<em>a<br>""b</em>'], '']);
+      assert.deepStrictEqual(inspect(parser('"*a\nb*'), ctx), [['"', '*', 'a', '<br>', 'b', '*'], '']);
+      assert.deepStrictEqual(inspect(parser('"*a\n""b*'), ctx), [['"', '*', 'a', '<br>', '"', '"', 'b', '*'], '']);
       assert.deepStrictEqual(inspect(parser('"a\n"*b"c*'), ctx), [['"', 'a', '<br>', '"', '*', 'b', '"', 'c', '*'], '']);
-      assert.deepStrictEqual(inspect(parser('"*a**b\nc**"("*'), ctx), [['"', '<em>a<strong>b<br>c</strong>"("</em>'], '']);
-      assert.deepStrictEqual(inspect(parser('<bdi>a"\nb</bdi>'), ctx), [['<bdi>a"<br>b</bdi>'], '']);
-      assert.deepStrictEqual(inspect(parser('"<bdi>"a\n""b</bdi>"'), ctx), [['"', '<bdi>"a<br>""b</bdi>', '"'], '']);
+      assert.deepStrictEqual(inspect(parser('"*a**b\nc**"("*'), ctx), [['"', '*', 'a', '**', 'b', '<br>', 'c', '**', '"', '(', '"', '*'], '']);
+      assert.deepStrictEqual(inspect(parser('[% a"\nb %]'), ctx), [['<span class="remark"><input type="checkbox"><span>[% a"<br>b %]</span></span>'], '']);
+      assert.deepStrictEqual(inspect(parser('"<bdi>"a\n""b</bdi>"'), ctx), [['"', '<span class="invalid">&lt;bdi&gt;</span>', '"', 'a', '<br>', '"', '"', 'b', '</bdi', '>', '"'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi>*<bdi>a</bdi>*</bdi>'), ctx), [['<bdi><em><bdi>a</bdi></em></bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi>((<bdi>((a))</bdi>))</bdi>'), ctx), [['<bdi><sup class="annotation"><span><bdi><span class="paren">((a))</span></bdi></span></sup></bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi>[[<bdi>[[a]]</bdi>]]</bdi>'), ctx), [['<bdi><sup class="reference"><span><bdi>[[a]]</bdi></span></sup></bdi>'], '']);
-      assert.deepStrictEqual(inspect(parser('<bdi>[#</bdi>]'), ctx), [['<bdi>[#</bdi>', ']'], '']);
-      assert.deepStrictEqual(inspect(parser('"<bdi>("")</bdi>'), ctx), [['"', '<bdi><span class="paren">("")</span></bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>[#</bdi>]'), ctx), [['<span class="invalid">&lt;bdi&gt;[#&lt;/bdi&gt;]</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('"<bdi>("")</bdi>'), ctx), [['"', '<span class="invalid">&lt;bdi&gt;(</span>', '"', '"', ')', '</bdi', '>'], '']);
       assert.deepStrictEqual(inspect(parser('++\na\n++\n~~\nb\n~~\nc'), ctx), [['<ins><br>a</ins>', '<br>', '<del><br>b</del>', '<br>', 'c'], '']);
       assert.deepStrictEqual(inspect(parser('[@a]'), ctx), [['[', '<a class="account" href="/@a">@a</a>', ']'], '']);
       assert.deepStrictEqual(inspect(parser('[#1][#2]'), ctx), [['<a class="index" href="#index::1">1</a>', '<a class="index" href="#index::2">2</a>'], '']);
@@ -121,11 +121,11 @@ describe('Unit: parser/inline', () => {
       assert.deepStrictEqual(inspect(parser('{}'), ctx), [['{', '}'], '']);
       assert.deepStrictEqual(inspect(parser('{a}'), ctx), [['<a class="url" href="a">a</a>'], '']);
       assert.deepStrictEqual(inspect(parser('{{a}}'), ctx), [['<span class="template">{{a}}</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('\r!{}'), ctx), [['!', '{', '}'], '']);
-      assert.deepStrictEqual(inspect(parser('\r!{a}'), ctx), [['!', '<a class="url" href="a">a</a>'], '']);
-      assert.deepStrictEqual(inspect(parser('\r!{{a}}'), ctx), [['!', '<span class="template">{{a}}</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('\r!{{{a}}}'), ctx), [['!', '<span class="template">{{{a}}}</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('\r!!{a}'), ctx), [['!', '!', '<a class="url" href="a">a</a>'], '']);
+      assert.deepStrictEqual(inspect(parser('!{}'), ctx), [['!', '{', '}'], '']);
+      assert.deepStrictEqual(inspect(parser('!{a}'), ctx), [['!', '<a class="url" href="a">a</a>'], '']);
+      assert.deepStrictEqual(inspect(parser('!{{a}}'), ctx), [['!', '<span class="template">{{a}}</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('!{{{a}}}'), ctx), [['!', '<span class="template">{{{a}}}</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('!!{a}'), ctx), [['!', '!', '<a class="url" href="a">a</a>'], '']);
       assert.deepStrictEqual(inspect(parser('${a}'), ctx), [['$', '<a class="url" href="a">a</a>'], '']);
       assert.deepStrictEqual(inspect(parser('${{a}}'), ctx), [['$', '<span class="template">{{a}}</span>'], '']);
       assert.deepStrictEqual(inspect(parser('${{{a}}}'), ctx), [['$', '<span class="template">{{{a}}}</span>'], '']);
@@ -167,8 +167,8 @@ describe('Unit: parser/inline', () => {
       assert.deepStrictEqual(inspect(parser('"{{""}}'), ctx), [['"', '{', '{', '"', '"', '}', '}'], '']);
       assert.deepStrictEqual(inspect(parser('[#http://host/(<bdi>)]</bdi>'), ctx), [['<a class="index" href="#index::http://host/(&lt;bdi&gt;)">http://host/(&lt;bdi&gt;)</a>', '</bdi', '>'], '']);
       assert.deepStrictEqual(inspect(parser('[#@a/http://host/(<bdi>)]</bdi>'), ctx), [['<a class="index" href="#index::@a/http://host/(&lt;bdi&gt;)">@a/http://host/(&lt;bdi&gt;)</a>', '</bdi', '>'], '']);
-      assert.deepStrictEqual(inspect(parser('[#a|<bdi>]</bdi>'), ctx), [['[', '<a class="hashtag" href="/hashtags/a">#a</a>', '|', '<bdi>]</bdi>'], '']);
-      assert.deepStrictEqual(inspect(parser('[[#a|<bdi>]</bdi>'), ctx), [['[', '[', '<a class="hashtag" href="/hashtags/a">#a</a>', '|', '<bdi>]</bdi>'], '']);
+      assert.deepStrictEqual(inspect(parser('[#a|<bdi>]</bdi>'), ctx), [['<a class="index" href="#index::a|&lt;bdi&gt;">a|<span class="invalid">&lt;bdi&gt;</span></a>', '</bdi', '>'], '']);
+      assert.deepStrictEqual(inspect(parser('[[#a|<bdi>]</bdi>'), ctx), [['[', '<a class="index" href="#index::a|&lt;bdi&gt;">a|<span class="invalid">&lt;bdi&gt;</span></a>', '</bdi', '>'], '']);
     });
 
     it('uri', () => {