Fix incomplete comments in safe mode not being escaped

trentm · Jan 3, 2024 · 82f2ea6 · 82f2ea6
1 parent b94feac
commit 82f2ea6
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 1 deletion.
diff --git a/lib/markdown2.py b/lib/markdown2.py
@@ -2639,7 +2639,7 @@ def _encode_amps_and_angles(self, text):
         text = self._naked_gt_re.sub('&gt;', text)
         return text
 
-    _incomplete_tags_re = re.compile(r"<(/?\w+?(?!\w)\s*?.+?[\s/]+?)")
+    _incomplete_tags_re = re.compile(r"<(!--|/?\w+?(?!\w)\s*?.+?[\s/]+?)")
 
     def _encode_incomplete_tags(self, text):
         if self.safe_mode not in ("replace", "escape"):

diff --git a/test/tm-cases/basic_safe_mode_escape.html b/test/tm-cases/basic_safe_mode_escape.html
@@ -3,3 +3,5 @@
 <p>&lt;div&gt;yowzer!&lt;/div&gt;</p>
 
 <p>blah</p>
+
+<p><em>foo</em> &lt;!-- <em>bar</em></p>
diff --git a/test/tm-cases/basic_safe_mode_escape.text b/test/tm-cases/basic_safe_mode_escape.text
@@ -3,3 +3,6 @@ blah <img src="dangerous"> blah
 <div>yowzer!</div>
 
 blah
+
+
+*foo* <!-- *bar*