Fix to remove non-terminated character references

Related-to: remarkjs/remark#913.
syntax-tree · Oct 24, 2022 · 857caa4 · 857caa4
1 parent 5bd2e1e
commit 857caa4
Show file tree

Hide file tree

Showing 3 changed files with 46 additions and 3 deletions.
diff --git a/complex-types.d.ts b/complex-types.d.ts
@@ -3,6 +3,8 @@ import type {PhrasingContent, BlockContent} from 'mdast'
 
 type DirectiveAttributes = Record<string, string>
 
+/* eslint-disable @typescript-eslint/consistent-type-definitions */
+
 interface DirectiveFields {
   name: string
   attributes?: DirectiveAttributes
@@ -33,3 +35,5 @@ declare module 'mdast' {
     leafDirective: LeafDirective
   }
 }
+
+/* eslint-enable @typescript-eslint/consistent-type-definitions */
diff --git a/index.js b/index.js
@@ -154,23 +154,35 @@ function exitAttributeIdValue(token) {
   const list = /** @type {Array.<[string, string]>} */ (
     this.getData('directiveAttributes')
   )
-  list.push(['id', parseEntities(this.sliceSerialize(token))])
+  list.push([
+    'id',
+    parseEntities(this.sliceSerialize(token), {
+      attribute: true
+    })
+  ])
 }
 
 /** @type {FromMarkdownHandle} */
 function exitAttributeClassValue(token) {
   const list = /** @type {Array.<[string, string]>} */ (
     this.getData('directiveAttributes')
   )
-  list.push(['class', parseEntities(this.sliceSerialize(token))])
+  list.push([
+    'class',
+    parseEntities(this.sliceSerialize(token), {
+      attribute: true
+    })
+  ])
 }
 
 /** @type {FromMarkdownHandle} */
 function exitAttributeValue(token) {
   const list = /** @type {Array.<[string, string]>} */ (
     this.getData('directiveAttributes')
   )
-  list[list.length - 1][1] = parseEntities(this.sliceSerialize(token))
+  list[list.length - 1][1] = parseEntities(this.sliceSerialize(token), {
+    attribute: true
+  })
 }
 
 /** @type {FromMarkdownHandle} */

diff --git a/test.js b/test.js
@@ -197,6 +197,33 @@ test('markdown -> mdast', (t) => {
     'should support attributes'
   )
 
+  t.deepEqual(
+    removePosition(
+      fromMarkdown(':a{b=&param c="&param" d=\'&param\'}', {
+        extensions: [directive()],
+        mdastExtensions: [directiveFromMarkdown]
+      }),
+      true
+    ),
+    {
+      type: 'root',
+      children: [
+        {
+          type: 'paragraph',
+          children: [
+            {
+              type: 'textDirective',
+              name: 'a',
+              attributes: {b: '&param', c: '&param', d: '&param'},
+              children: []
+            }
+          ]
+        }
+      ]
+    },
+    'should not support non-terminated character references'
+  )
+
   t.deepEqual(
     removePosition(
       fromMarkdown(':a{b\nc="d\ne"}', {