Merge branch 'master' into fix/consistency_follow

test/data/email.html

@@ -1 +1,2 @@
-<p>my email is <a href="mailto:me@example.com">me@example.com</a></p>
+<p>my email is <a href="mailto:me@example.com">me@example.com</a></p>
+<p>html tags shouldn't start an email autolink <strong>first.last@example.com</strong></p>

test/data/email.md

@@ -1 +1,3 @@
-my email is <me@example.com>
+my email is <me@example.com>
+
+html tags shouldn't start an email autolink <strong>first.last@example.com</strong>

test/data/fenced_code_block.html

@@ -3,4 +3,9 @@
 $message = 'fenced code block';
 echo $message;</code></pre>
 <pre><code>tilde</code></pre>
-<pre><code class="language-php">echo 'language identifier';</code></pre>
+<pre><code class="language-php">echo 'language identifier';</code></pre>
+<pre><code class="language-c#">echo 'language identifier with non words';</code></pre>
+<pre><code class="language-html+php">&lt;?php
+echo "Hello World";
+?&gt;
+&lt;a href="http://auraphp.com" &gt;Aura Project&lt;/a&gt;</code></pre>

test/data/fenced_code_block.md

@@ -11,4 +11,15 @@ tilde
 
 ```php
 echo 'language identifier';
+```
+
+```c#
+echo 'language identifier with non words';
+```
+
+```html+php
+<?php
+echo "Hello World";
+?>
+<a href="http://auraphp.com" >Aura Project</a>
 ```

test/data/multiline_lists.html

@@ -0,0 +1,10 @@
+<ol>
+<li>
+<p>One
+First body copy</p>
+</li>
+<li>
+<p>Two
+Last body copy</p>
+</li>
+</ol>

test/data/multiline_lists.md

@@ -0,0 +1,5 @@
+1. One
+   First body copy
+
+2. Two
+   Last body copy

test/data/paragraph_list.html

@@ -8,5 +8,7 @@
 <li>
 <p>li</p>
 </li>
-<li>li</li>
+<li>
+<p>li</p>
+</li>
 </ul>

test/data/sparse_dense_list.html

@@ -2,6 +2,10 @@
 <li>
 <p>li</p>
 </li>
-<li>li</li>
-<li>li</li>
+<li>
+<p>li</p>
+</li>
+<li>
+<p>li</p>
+</li>
 </ul>

test/data/sparse_list.html

@@ -2,7 +2,9 @@
 <li>
 <p>li</p>
 </li>
-<li>li</li>
+<li>
+<p>li</p>
+</li>
 </ul>
 <hr />
 <ul>

test/data/xss_attribute_encoding.html

@@ -0,0 +1,6 @@
+<p><a href="https://www.example.com&quot;">xss</a></p>
+<p><img src="https://www.example.com&quot;" alt="xss" /></p>
+<p><a href="https://www.example.com&#039;">xss</a></p>
+<p><img src="https://www.example.com&#039;" alt="xss" /></p>
+<p><img src="https://www.example.com" alt="xss&quot;" /></p>
+<p><img src="https://www.example.com" alt="xss&#039;" /></p>

test/data/xss_attribute_encoding.md

@@ -0,0 +1,11 @@
+[xss](https://www.example.com")
+
+![xss](https://www.example.com")
+
+[xss](https://www.example.com')
+
+![xss](https://www.example.com')
+
+![xss"](https://www.example.com)
+
+![xss'](https://www.example.com)

test/data/xss_bad_url.html

@@ -0,0 +1,16 @@
+<p><a href="javascript%3Aalert(1)">xss</a></p>
+<p><a href="javascript%3Aalert(1)">xss</a></p>
+<p><a href="javascript%3A//alert(1)">xss</a></p>
+<p><a href="javascript&amp;colon;alert(1)">xss</a></p>
+<p><img src="javascript%3Aalert(1)" alt="xss" /></p>
+<p><img src="javascript%3Aalert(1)" alt="xss" /></p>
+<p><img src="javascript%3A//alert(1)" alt="xss" /></p>
+<p><img src="javascript&amp;colon;alert(1)" alt="xss" /></p>
+<p><a href="data%3Atext/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">xss</a></p>
+<p><a href="data%3Atext/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">xss</a></p>
+<p><a href="data%3A//text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">xss</a></p>
+<p><a href="data&amp;colon;text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">xss</a></p>
+<p><img src="data%3Atext/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==" alt="xss" /></p>
+<p><img src="data%3Atext/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==" alt="xss" /></p>
+<p><img src="data%3A//text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==" alt="xss" /></p>
+<p><img src="data&amp;colon;text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==" alt="xss" /></p>

test/data/xss_bad_url.md

@@ -0,0 +1,31 @@
+[xss](javascript:alert(1))
+
+[xss]( javascript:alert(1))
+
+[xss](javascript://alert(1))
+
+[xss](javascript:alert(1))
+
+![xss](javascript:alert(1))
+
+![xss]( javascript:alert(1))
+
+![xss](javascript://alert(1))
+
+![xss](javascript:alert(1))
+
+[xss](data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==)
+
+[xss]( data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==)
+
+[xss](data://text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==)
+
+[xss](data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==)
+
+![xss](data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==)
+
+![xss]( data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==)
+
+![xss](data://text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==)
+
+![xss](data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==)

test/data/xss_text_encoding.html

@@ -0,0 +1,7 @@
+<p>&lt;script&gt;alert(1)&lt;/script&gt;</p>
+<p>&lt;script&gt;</p>
+<p>alert(1)</p>
+<p>&lt;/script&gt;</p>
+<p>&lt;script&gt;
+alert(1)
+&lt;/script&gt;</p>

test/data/xss_text_encoding.md

@@ -0,0 +1,12 @@
+<script>alert(1)</script>
+
+<script>
+
+alert(1)
+
+</script>
+
+
+<script>
+alert(1)
+</script>