mdit-py-plugins 0.6.0__tar.gz → 0.7.0__tar.gz

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdit-py-plugins
-Version: 0.6.0
+Version: 0.7.0
 Summary: Collection of plugins for markdown-it-py
 Keywords: markdown,markdown-it,lexer,parser,development
 Author-email: Chris Sewell <chrisj_sewell@hotmail.com>
@@ -10,17 +10,17 @@ Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Text Processing :: Markup
 License-File: LICENSE
-Requires-Dist: markdown-it-py>=2.0.0,<5.0.0
+Requires-Dist: markdown-it-py>=3.0.0,<5.0.0
 Requires-Dist: pre-commit ; extra == "code-style"
 Requires-Dist: myst-parser ; extra == "rtd"
 Requires-Dist: sphinx-book-theme ; extra == "rtd"

mdit_py_plugins-0.7.0/mdit_py_plugins/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.7.0"

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/admon/index.py

@@ -20,7 +20,12 @@ if TYPE_CHECKING:
 
 def _get_multiple_tags(params: str) -> tuple[list[str], str]:
     """Check for multiple tags when the title is double quoted."""
-    re_tags = re.compile(r'^\s*(?P<tokens>[^"]+)\s+"(?P<title>.*)"\S*$')
+    # This matches what r'^\s*(?P<tokens>[^"]+)\s+"(?P<title>.*)"\S*$' matches,
+    # but the tokens end on a non-space and only the last quote can close the title,
+    # so a long run of spaces or quotes cannot make it backtrack quadratically (#143).
+    re_tags = re.compile(
+        r'^\s*(?P<tokens>[^"\s](?:[^"]*[^"\s])?)\s+"(?P<title>.*)"[^\s"]*$'
+    )
     match = re_tags.match(params)
     if match:
         tags = match["tokens"].strip().split(" ")
@@ -183,7 +188,7 @@ def admonition(state: StateBlock, startLine: int, endLine: int, silent: bool) ->
     return True
 
 
-def admon_plugin(md: MarkdownIt, render: None | Callable[..., str] = None) -> None:
+def admon_plugin(md: MarkdownIt, render: Callable[..., str] | None = None) -> None:
     """Plugin to use
     `python-markdown style admonitions
     <https://python-markdown.github.io/extensions/admonition>`_.

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/anchors/index.py

@@ -29,6 +29,10 @@ def anchors_plugin(
 
         <h1 id="title-string">Title String <a class="header-anchor" href="#title-string">¶</a></h1>
 
+    Explicit heading IDs (e.g. ``{#id}`` from ``attrs_block_plugin``) are preserved,
+    at any level, and generated IDs avoid collisions with them.
+    Explicit IDs are not de-duplicated, and an empty explicit ID counts as no ID.
+
     :param min_level: minimum header level to apply anchors
     :param max_level: maximum header level to apply anchors
     :param slug_func: function to convert title text to id slug.
@@ -66,7 +70,14 @@ def _make_anchors_func(
     permalinkSpace: bool,
 ) -> Callable[[StateCore], None]:
     def _anchor_func(state: StateCore) -> None:
-        slugs: set[str] = set()
+        # reserve every explicit heading id (at any level) up front,
+        # so a generated slug never collides with one, whatever the order;
+        # an empty id is treated as absent
+        slugs: set[str] = {
+            str(heading_id)
+            for token in state.tokens
+            if token.type == "heading_open" and (heading_id := token.attrGet("id"))
+        }
         for idx, token in enumerate(state.tokens):
             if token.type != "heading_open":
                 continue
@@ -80,8 +91,10 @@ def _make_anchors_func(
                 for child in inline_token.children
                 if child.type in ["text", "code_inline"]
             )
-            slug = unique_slug(slug_func(title), slugs)
-            token.attrSet("id", slug)
+            slug = token.attrGet("id")
+            if not slug:
+                slug = unique_slug(slug_func(title), slugs)
+                token.attrSet("id", slug)
 
             if permalink:
                 link_open = Token(
@@ -116,7 +129,7 @@ def _make_anchors_func(
 
 
 def slugify(title: str) -> str:
-    return re.sub(r"[^\w\u4e00-\u9fff\- ]", "", title.strip().lower().replace(" ", "-"))
+    return re.sub(r"[^\w\u4e00-\u9fff\- ]", "", title.lower().replace(" ", "-"))
 
 
 def unique_slug(slug: str, slugs: set[str]) -> str:

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/attrs/index.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from collections.abc import Sequence
 from functools import partial
+import re
 from typing import Any
 
 from markdown_it import MarkdownIt
@@ -41,8 +42,14 @@ def attrs_plugin(
     - `key="value"` or `key=value` specifies a key-value attribute.
        Quotes are not needed when the value consists entirely of
        ASCII alphanumeric characters or `_` or `:` or `-`.
-       Backslash escapes may be used inside quoted values.
-    - `%` begins a comment, which ends with the next `%` or the end of the attribute (`}`).
+       Backslash escapes may be used inside quoted values,
+       to allow a ``"`` character within the value.
+       Note that the backslash is retained in the value:
+       ``{k="a\\"b"}`` gives ``k`` the value ``a\\"b``.
+    - `%` begins a comment, which ends with the next `%`.
+      If no further `%` occurs in the rest of the line (for a block attribute)
+      or of the inline content (for an inline attribute),
+      the comment instead ends at the next `}`, which also ends the attribute.
 
     Multiple attribute blocks are merged.
 
@@ -56,10 +63,24 @@ def attrs_plugin(
     :param allowed: A list of allowed attribute names.
         If not ``None``, any attributes not in this list will be removed
         and placed in the token's meta under the key "insecure_attrs".
+        If ``None`` (the default), event-handler attributes
+        (any name starting with ``on``, such as ``onclick``) are still removed,
+        as a baseline protection against script injection.
+        Other attributes, including ``style``, are kept.
+        Whatever ``allowed`` says, the URL-valued attributes
+        ``href``, ``src``, ``action``, ``formaction`` and ``xlink:href``
+        are removed when ``md.validateLink`` rejects their value
+        (for example a ``javascript:`` URL), as for Markdown links and images.
+        This is not a full sanitiser: to safely render untrusted input,
+        pass an explicit ``allowed`` list (e.g. ``("id", "class")``).
     """
 
     if spans:
-        md.inline.ruler.after(span_after, "span", _span_rule)
+        md.inline.ruler.after(
+            span_after,
+            "span",
+            partial(_span_rule, allowed=None if allowed is None else set(allowed)),
+        )
     if after:
         md.inline.ruler.push(
             "attr",
@@ -91,6 +112,16 @@ def attrs_block_plugin(md: MarkdownIt, *, allowed: Sequence[str] | None = None)
     :param allowed: A list of allowed attribute names.
         If not ``None``, any attributes not in this list will be removed
         and placed in the token's meta under the key "insecure_attrs".
+        If ``None`` (the default), event-handler attributes
+        (any name starting with ``on``, such as ``onclick``) are still removed,
+        as a baseline protection against script injection.
+        Other attributes, including ``style``, are kept.
+        Whatever ``allowed`` says, the URL-valued attributes
+        ``href``, ``src``, ``action``, ``formaction`` and ``xlink:href``
+        are removed when ``md.validateLink`` rejects their value
+        (for example a ``javascript:`` URL), as for Markdown links and images.
+        This is not a full sanitiser: to safely render untrusted input,
+        pass an explicit ``allowed`` list (e.g. ``("id", "class")``).
     """
     md.block.ruler.before("fence", "attr", _attr_block_rule)
     md.core.ruler.after(
@@ -115,7 +146,9 @@ def _find_opening(tokens: Sequence[Token], index: int) -> int | None:
     return None
 
 
-def _span_rule(state: StateInline, silent: bool) -> bool:
+def _span_rule(
+    state: StateInline, silent: bool, *, allowed: set[str] | None = None
+) -> bool:
     if state.src[state.pos] != "[":
         return False
 
@@ -144,7 +177,7 @@ def _span_rule(state: StateInline, silent: bool) -> bool:
         state.pos = labelStart
         state.posMax = labelEnd
         token = state.push("span_open", "span", 1)
-        token.attrs = attrs  # type: ignore[assignment]
+        _add_attrs(state.md, token, attrs, allowed)
         state.md.inline.tokenize(state)
         token = state.push("span_close", "span", -1)
 
@@ -175,9 +208,9 @@ def _attr_inline_rule(
     state.pos += new_pos + 1
     if not silent:
         attr_token = state.tokens[token_index]
-        if "class" in attrs and "class" in token.attrs:
-            attrs["class"] = f"{token.attrs['class']} {attrs['class']}"
-        _add_attrs(attr_token, attrs, allowed)
+        if "class" in attrs and "class" in attr_token.attrs:
+            attrs["class"] = f"{attr_token.attrs['class']} {attrs['class']}"
+        _add_attrs(state.md, attr_token, attrs, allowed)
     return True
 
 
@@ -238,7 +271,8 @@ def _attr_resolve_block_rule(state: StateCore, *, allowed: set[str] | None) -> N
             i += 1
             continue
 
-        if i + 1 < len_tokens:
+        # skip closing tokens; attributes would be rendered into the closing tag
+        if i + 1 < len_tokens and state.tokens[i + 1].nesting >= 0:
             next_token = state.tokens[i + 1]
 
             # classes are appended
@@ -253,23 +287,69 @@ def _attr_resolve_block_rule(state: StateCore, *, allowed: set[str] | None) -> N
                     if key == "class" or key not in next_token.attrs:
                         next_token.attrs[key] = value
             else:
-                _add_attrs(next_token, state.tokens[i].attrs, allowed)
+                _add_attrs(state.md, next_token, state.tokens[i].attrs, allowed)
 
         state.tokens.pop(i)
         len_tokens -= 1
 
 
+_URL_ATTRS = frozenset(("href", "src", "action", "formaction", "xlink:href"))
+"""Attributes whose value is a URL, checked with ``md.validateLink``."""
+
+_URL_IGNORED_RE = re.compile(r"[\t\n\r]")
+_URL_STRIP = "".join(chr(i) for i in range(0x21))
+
+
+def _is_insecure_attr(key: str) -> bool:
+    """Return True for event-handler attributes (``on*``, e.g. ``onclick``).
+
+    They execute JavaScript, so they are removed by default
+    when no explicit ``allowed`` list is given.
+    """
+    return key.lower().startswith("on")
+
+
+def _is_valid_url(md: MarkdownIt, value: Any) -> bool:
+    """Return True if ``md.validateLink`` accepts a URL-valued attribute.
+
+    Browsers ignore ASCII tabs and newlines anywhere in a URL,
+    and control characters and spaces around it, before reading its scheme
+    (so ``java<TAB>script:`` is a ``javascript:`` URL).
+    The value is emitted as written, so those characters are removed
+    before it is normalised and validated.
+    """
+    url = _URL_IGNORED_RE.sub("", str(value)).strip(_URL_STRIP)
+    return md.validateLink(md.normalizeLink(url))
+
+
 def _add_attrs(
+    md: MarkdownIt,
     token: Token,
     attrs: dict[str, Any],
     allowed: set[str] | None,
 ) -> None:
-    """Add attributes to a token, skipping any disallowed attributes."""
-    if allowed is not None and (
-        disallowed := {k: v for k, v in attrs.items() if k not in allowed}
-    ):
+    """Add attributes to a token, skipping any disallowed attributes.
+
+    When ``allowed`` is not ``None`` only those names are kept.
+    When it is ``None`` (the default) event-handler (``on*``) attributes
+    are still removed, so untrusted input cannot inject script.
+    In both cases, a URL-valued attribute (``href``, ``src``, ...)
+    is removed if ``md.validateLink`` rejects it.
+    Anything removed is preserved in ``token.meta["insecure_attrs"]``.
+    """
+    if allowed is not None:
+        disallowed = {k: v for k, v in attrs.items() if k not in allowed}
+    else:
+        disallowed = {k: v for k, v in attrs.items() if _is_insecure_attr(k)}
+    disallowed.update(
+        (k, v)
+        for k, v in attrs.items()
+        if k not in disallowed and k.lower() in _URL_ATTRS and not _is_valid_url(md, v)
+    )
+
+    if disallowed:
         token.meta["insecure_attrs"] = disallowed
-        attrs = {k: v for k, v in attrs.items() if k in allowed}
+        attrs = {k: v for k, v in attrs.items() if k not in disallowed}
 
     # attributes takes precedence over existing attributes
     token.attrs.update(attrs)

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/attrs/parse.py

@@ -100,17 +100,31 @@ def parse(string: str) -> tuple[int, dict[str, str]]:
     """Parse attributes from start of string.
 
     :returns: (length of parsed string, dict of attributes)
+    :raises ParseError: if the attributes are malformed,
+        or the string ends before the closing `}`
     """
     pos = 0
     state: State = State.START
     tokens = TokenState()
+    # found once, so that checking for a later `%` at each `}` does not
+    # rescan the rest of the string (which would be quadratic in its length)
+    last_percent = string.rfind("%")
     while pos < len(string):
-        state = HANDLERS[state](string[pos], pos, tokens)
+        if (
+            state == State.SCANNING_COMMENT
+            and string[pos] == "}"
+            and pos > last_percent
+        ):
+            # a comment ends at the next `%`, but there is none left to close it,
+            # so this `}` ends both the comment and the attributes
+            state = State.DONE
+        else:
+            state = HANDLERS[state](string[pos], pos, tokens)
         if state == State.DONE:
             return pos, tokens.compile(string)
         pos = pos + 1
 
-    return pos, tokens.compile(string)
+    raise ParseError("Attributes not terminated", pos)
 
 
 def handle_start(char: str, pos: int, tokens: TokenState) -> State:

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/colon_fence.py

@@ -153,7 +153,7 @@ def _render(
 
     return (
         "<pre><code"
-        + (f' class="block-{block_name}" ' if block_name else "")
+        + (f' class="block-{escapeHtml(block_name)}" ' if block_name else "")
         + ">"
         + content
         + "</code></pre>\n"

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/container/index.py

@@ -21,8 +21,8 @@ def container_plugin(
     md: MarkdownIt,
     name: str,
     marker: str = ":",
-    validate: None | Callable[[str, str], bool] = None,
-    render: None | Callable[..., str] = None,
+    validate: Callable[[str, str], bool] | None = None,
+    render: Callable[..., str] | None = None,
 ) -> None:
     """Plugin ported from
     `markdown-it-container <https://github.com/markdown-it/markdown-it-container>`__.

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/dollarmath/index.py

@@ -49,9 +49,28 @@ def dollarmath_plugin(
     :param label_normalizer: Function to normalize the label,
         by default replaces whitespace with `-`
     :param renderer: Function to render content: `(str, {"display_mode": bool}) -> str`,
-        by default escapes HTML
+        by default escapes HTML.
+        Its return value is placed inside the element as is,
+        so a custom renderer is responsible for escaping it (the default renderer does).
     :param label_renderer: Function to render labels, by default creates anchor
 
+    The plugin does not typeset the math.
+    Each token becomes an HTML element holding the rendered content,
+    and typesetting is left to a library such as MathJax or KaTeX:
+
+    - ``math_inline`` (``$a$``):
+      ``<span class="math inline">``, with ``display_mode=False``
+    - ``math_inline_double`` (``$$a$$`` inside a paragraph, with ``double_inline``):
+      ``<div class="math inline">``, with ``display_mode=True``
+    - ``math_block`` (``$$a$$`` on its own lines):
+      ``<div class="math block">``, with ``display_mode=True``
+    - ``math_block_label`` (``$$a$$ (eq1)``):
+      ``<div id="eq1" class="math block">``, starting with the label anchor,
+      with ``display_mode=True``
+
+    The tag says how to display the math (``div`` for display, ``span`` for inline),
+    and the class says where it was written (``inline`` inside a paragraph,
+    ``block`` on its own lines), as in executablebooks/markdown-it-dollarmath.
     """
     if label_normalizer is None:
         label_normalizer = lambda label: re.sub(r"\s+", "-", label)  # noqa: E731
@@ -79,7 +98,7 @@ def dollarmath_plugin(
     if label_renderer is None:
         _label_renderer = (  # noqa: E731
             lambda label: (
-                f'<a href="#{label}" class="mathlabel" title="Permalink to this equation">¶</a>'
+                f'<a href="#{escapeHtml(label)}" class="mathlabel" title="Permalink to this equation">¶</a>'
             )
         )
     else:
@@ -123,7 +142,7 @@ def dollarmath_plugin(
         env: EnvType,
     ) -> str:
         content = _renderer(str(tokens[idx].content).strip(), {"display_mode": True})
-        _id = tokens[idx].info
+        _id = escapeHtml(tokens[idx].info)
         label = _label_renderer(tokens[idx].info)
         return f'<div id="{_id}" class="math block">\n{label}\n{content}\n</div>\n'
 
@@ -287,6 +306,22 @@ def math_inline_dollar(
 DOLLAR_EQNO_REV = re.compile(r"^\s*\)([^)$\r\n]+?)\(\s*\${2}")
 
 
+def _math_block_content(
+    state: StateBlock, startLine: int, startPos: int, endLine: int, end: int
+) -> str:
+    """Extract math body, omitting parent container prefixes on each line."""
+    content_start = startPos + 2
+    if startLine == endLine:
+        return state.src[content_start:end]
+
+    parts: list[str] = [state.src[content_start : state.eMarks[startLine]], "\n"]
+    for line in range(startLine + 1, endLine):
+        parts.append(state.src[state.bMarks[line] : state.eMarks[line]])
+        parts.append("\n")
+    parts.append(state.src[state.bMarks[endLine] : end])
+    return "".join(parts)
+
+
 def math_block_dollar(
     allow_labels: bool = True,
     label_normalizer: Callable[[str], str] | None = None,
@@ -322,13 +357,21 @@ def math_block_dollar(
             if lineText.strip().endswith("$$"):
                 haveEndMarker = True
                 end = end - 2 - (len(lineText) - len(lineText.strip()))
-            elif allow_labels:
-                # reverse the line and match
-                eqnoMatch = DOLLAR_EQNO_REV.match(lineText[::-1])
-                if eqnoMatch:
-                    haveEndMarker = True
-                    label = eqnoMatch.group(1)[::-1]
-                    end = end - eqnoMatch.end()
+            else:
+                # a closing marker present but not at end of line and not a label
+                # suffix is ambiguous, so don't greedily scan subsequent lines for it
+                trailing_close = "$$" in lineText[2:]
+                if allow_labels:
+                    # reverse the line and match
+                    eqnoMatch = DOLLAR_EQNO_REV.match(lineText[::-1])
+                    if eqnoMatch:
+                        haveEndMarker = True
+                        label = eqnoMatch.group(1)[::-1]
+                        end = end - eqnoMatch.end()
+                    elif trailing_close:
+                        return False
+                elif trailing_close:
+                    return False
 
         # search for end of block on subsequent line
         if not haveEndMarker:
@@ -365,7 +408,7 @@ def math_block_dollar(
 
         token = state.push("math_block_label" if label else "math_block", "math", 0)
         token.block = True
-        token.content = state.src[startPos + 2 : end]
+        token.content = _math_block_content(state, startLine, startPos, nextLine, end)
         token.markup = "$$"
         token.map = [startLine, state.line]
         if label:

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/field_list/__init__.py

@@ -164,8 +164,9 @@ def _fieldlist_rule(
             while _line < endLine:
                 # if start_of_content < end_of_content, then non-empty line
                 if (state.bMarks[_line] + state.tShift[_line]) < state.eMarks[_line]:
-                    if state.tShift[_line] <= 0:
-                        # the line has no indent, so it's the end of the field
+                    if state.tShift[_line] <= state.blkIndent:
+                        # the line is not indented relative to the field marker,
+                        # so it's the end of the field body
                         break
                     block_indent = (
                         state.tShift[_line]

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/footnote/index.py

@@ -227,6 +227,8 @@ def footnote_inline(state: StateInline, silent: bool) -> bool:
         footnoteId = len(refs)
 
         tokens: list[Token] = []
+        # Reserve the ID before parsing content that may allocate more footnotes.
+        refs[footnoteId] = {"content": state.src[labelStart:labelEnd], "tokens": tokens}
         state.md.inline.parse(
             state.src[labelStart:labelEnd], state.md, state.env, tokens
         )
@@ -234,8 +236,6 @@ def footnote_inline(state: StateInline, silent: bool) -> bool:
         token = state.push("footnote_ref", "", 0)
         token.meta = {"id": footnoteId}
 
-        refs[footnoteId] = {"content": state.src[labelStart:labelEnd], "tokens": tokens}
-
     state.pos = labelEnd + 1
     state.posMax = maximum
     return True

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/front_matter/index.py

@@ -69,12 +69,19 @@ def _front_matter_rule(
             # unclosed block should be autoclosed by end of document.
             return False
 
-        if state.src[start:maximum] == "...":
-            break
-
         start = state.bMarks[nextLine] + state.tShift[nextLine]
         maximum = state.eMarks[nextLine]
 
+        if (
+            state.sCount[nextLine] == 0
+            and state.src.startswith("...", start)
+            and state.skipSpaces(start + 3) >= maximum
+        ):
+            # YAML document-end marker: `...` at column 0, trailing spaces allowed.
+            # It is checked on the current line and consumed, so it is not content.
+            auto_closed = True
+            break
+
         if start < maximum and state.sCount[nextLine] < state.blkIndent:
             # non-empty line with negative indent should stop the list:
             # - ```

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/gfm_autolink/index.py

@@ -159,7 +159,10 @@ def _www_inline_rule(state: StateInline, silent: bool) -> bool:
     label = src[pos : pos + length]
 
     if silent:
-        return True
+        # Autolinks are only recognised when emitting tokens. When skipping
+        # silently (e.g. scanning a link label), report no match so the parser
+        # steps over this text as plain characters (#160).
+        return False
 
     full_url = state.md.normalizeLink(url)
     if not state.md.validateLink(full_url):
@@ -223,7 +226,7 @@ def _protocol_rule(state: StateInline, silent: bool) -> bool:
     label = combined[:total_len]
 
     if silent:
-        return True
+        return False  # see _www_inline_rule
     return _create_autolink(state, bscan_len, total_len, full_url, label)
 
 
@@ -291,5 +294,5 @@ def _email_rule(state: StateInline, silent: bool) -> bool:
     url = "mailto:" + email_text
 
     if silent:
-        return True
+        return False  # see _www_inline_rule
     return _create_autolink(state, local_len, total_len, url, email_text)

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/myst_blocks/index.py

@@ -152,7 +152,7 @@ def render_myst_target(
     options: OptionsDict,
     env: EnvType,
 ) -> str:
-    label = tokens[idx].content
+    label = escapeHtml(tokens[idx].content)
     class_name = "myst-target"
     target = f'<a href="#{label}">({label})=</a>'
     return f'<div class="{class_name}">{target}</div>'

{mdit_py_plugins-0.6.0 → mdit_py_plugins-0.7.0}/mdit_py_plugins/myst_role/index.py

@@ -21,20 +21,15 @@ def myst_role_plugin(md: MarkdownIt) -> None:
 
 
 def myst_role(state: StateInline, silent: bool) -> bool:
+    # note ``\{`` escaping is handled by the core ``escape`` rule,
+    # which runs before this rule
+
     # check name
     match = VALID_NAME_PATTERN.match(state.src[state.pos :])
     if not match:
         return False
     name = match.group(1)
 
-    # check for starting backslash escape
-    try:
-        if state.src[state.pos - 1] == "\\":
-            # escaped (this could be improved in the case of edge case '\\{')
-            return False
-    except IndexError:
-        pass
-
     # scan opening tick length
     start = pos = state.pos + match.end()
     try:

mdit_py_plugins-0.7.0/mdit_py_plugins/section_ref/__init__.py

@@ -0,0 +1,12 @@
+"""Section reference plugin for markdown-it-py.
+
+Captures section-sign references such as ``§1``, ``§1.1`` and ``§2.3.4``
+into dedicated ``section_ref`` tokens, so downstream renderers
+(e.g. MyST-Parser) can resolve them to numbered heading cross-references.
+
+Requires markdown-it-py >= 4.1.0.
+"""
+
+from .index import section_ref_plugin
+
+__all__ = ("section_ref_plugin",)