Commit 0e920268 authored by Emanuil Rusev's avatar Emanuil Rusev
Browse files

escaping of "<" breaks span-level html

parent 7249d02c
......@@ -564,7 +564,9 @@ class Parsedown
{
foreach ($matches as $matches)
{
$url = $this->escape_special_characters($matches[4]);
$url = $matches[4];
strpos($url, '&') !== FALSE and $url = preg_replace('/&(?!#?\w+;)/', '&amp;', $url);
if ($matches[1]) # image
{
......@@ -604,7 +606,8 @@ class Parsedown
if (isset($this->reference_map[$link_definition]))
{
$url = $this->reference_map[$link_definition];
$url = $this->escape_special_characters($url);
strpos($url, '&') !== FALSE and $url = preg_replace('/&(?!#?\w+;)/', '&amp;', $url);
if ($matches[1]) # image
{
......@@ -636,7 +639,9 @@ class Parsedown
{
foreach ($matches as $matches)
{
$url = $this->escape_special_characters($matches[1]);
$url = $matches[1];
strpos($url, '&') !== FALSE and $url = preg_replace('/&(?!#?\w+;)/', '&amp;', $url);
$element = '<a href=":href">:text</a>';
$element = str_replace(':text', $url, $element);
......@@ -656,8 +661,9 @@ class Parsedown
# ~
$text = $this->escape_special_characters($text);
strpos($text, '&') !== FALSE and $text = preg_replace('/&(?!#?\w+;)/', '&amp;', $text);
strpos($text, '<') !== FALSE and $text = preg_replace('/<(?!\/?\w.*?>)/', '&lt;', $text);
# ~
if (strpos($text, '_') !== FALSE)
......@@ -676,13 +682,4 @@ class Parsedown
return $text;
}
private function escape_special_characters($text)
{
strpos($text, '&') !== FALSE and $text = preg_replace('/&(?!#?\w+;)/', '&amp;', $text);
$text = str_replace('<', '&lt;', $text);
return $text;
}
}
\ No newline at end of file
<p>Here's an <b>important</b> <a href=''>link</a>.</p>
\ No newline at end of file
Here's an <b>important</b> <a href=''>link</a>.
\ No newline at end of file
......@@ -4,5 +4,6 @@
<p>4 &lt; 5 and 6 > 5.</p>
<p>Here's a <a href="http://example.com/?foo=1&amp;bar=2">link</a> with an ampersand in the URL.</p>
<p>Here's an inline <a href="/script?foo=1&amp;bar=2">link</a>.</p>
<p><a href="http://example.com/autolink?a=1&amp;b=2">http://example.com/autolink?a=1&amp;b=2</a></p>
<hr />
<p>Based on <a href="http://daringfireball.net/projects/downloads/MarkdownTest_1.0.zip">the original</a> test suite.</p>
\ No newline at end of file
AT&T has an ampersand in their name.
AT&amp;T is another way to write it.
AT&T is another way to write it.
This & that.
......@@ -12,6 +12,8 @@ Here's an inline [link](/script?foo=1&bar=2).
[1]: http://example.com/?foo=1&bar=2
<http://example.com/autolink?a=1&b=2>
---
Based on [the original](http://daringfireball.net/projects/downloads/MarkdownTest_1.0.zip) test suite.
\ No newline at end of file
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment