From eac87b65d8b8804bfd50d232f699919b7ea2c637 Mon Sep 17 00:00:00 2001
From: Trevor Buckner <calculuschild@gmail.com>
Date: Wed, 26 Mar 2025 19:26:20 -0400
Subject: [PATCH] Update tests and custom link renderer

v15 changes where html gets escaped and escapes plain text more consistently. Needed to update tests to match.
---
 package-lock.json                          | 8 ++++----
 package.json                               | 2 +-
 shared/naturalcrit/markdown.js             | 2 +-
 tests/markdown/non-breaking-spaces.test.js | 6 +++---
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 87d573e8e..9ce7a789b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -33,7 +33,7 @@
         "jwt-simple": "^0.5.6",
         "less": "^3.13.1",
         "lodash": "^4.17.21",
-        "marked": "14.1.4",
+        "marked": "15.0.0",
         "marked-emoji": "^2.0.0",
         "marked-extended-tables": "^2.0.1",
         "marked-gfm-heading-id": "^4.0.1",
@@ -9892,9 +9892,9 @@
       }
     },
     "node_modules/marked": {
-      "version": "14.1.4",
-      "resolved": "https://registry.npmjs.org/marked/-/marked-14.1.4.tgz",
-      "integrity": "sha512-vkVZ8ONmUdPnjCKc5uTRvmkRbx4EAi2OkTOXmfTDhZz3OFqMNBM1oTTWwTr4HY4uAEojhzPf+Fy8F1DWa3Sndg==",
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-15.0.0.tgz",
+      "integrity": "sha512-0mouKmBROJv/WSHJBPZZyYofUgawMChnD5je/g+aOBXsHDjb/IsnTQj7mnhQZu+qPJmRQ0ecX3mLGEUm3BgwYA==",
       "license": "MIT",
       "bin": {
         "marked": "bin/marked.js"
diff --git a/package.json b/package.json
index 9e2a8450d..36471950a 100644
--- a/package.json
+++ b/package.json
@@ -107,7 +107,7 @@
     "jwt-simple": "^0.5.6",
     "less": "^3.13.1",
     "lodash": "^4.17.21",
-    "marked": "14.1.4",
+    "marked": "15.0.0",
     "marked-emoji": "^2.0.0",
     "marked-extended-tables": "^2.0.1",
     "marked-gfm-heading-id": "^4.0.1",
diff --git a/shared/naturalcrit/markdown.js b/shared/naturalcrit/markdown.js
index 0b90c051c..485aa281f 100644
--- a/shared/naturalcrit/markdown.js
+++ b/shared/naturalcrit/markdown.js
@@ -104,7 +104,7 @@ renderer.link = function (token) {
 	}
 	let out = `<a href="${escape(href)}"`;
 	if(title) {
-		out += ` title="${title}"`;
+		out += ` title="${escape(title)}"`;
 	}
 	if(self) {
 		out += ' target="_self"';
diff --git a/tests/markdown/non-breaking-spaces.test.js b/tests/markdown/non-breaking-spaces.test.js
index c4f36554a..83fb55509 100644
--- a/tests/markdown/non-breaking-spaces.test.js
+++ b/tests/markdown/non-breaking-spaces.test.js
@@ -54,19 +54,19 @@ describe('Non-Breaking Spaces', ()=>{
 	test('I am actually a single-line definition list!', function() {
 		const source = 'Term ::> Definition 1\n';
 		const rendered = Markdown.render(source).trim();
-		expect(rendered, `Input:\n${source}`, { showPrefix: false }).toBe(`<dl><dt>Term</dt><dd>> Definition 1</dd>\n</dl>`);
+		expect(rendered, `Input:\n${source}`, { showPrefix: false }).toBe(`<dl><dt>Term</dt><dd>&gt; Definition 1</dd>\n</dl>`);
 	});
 
 	test('I am actually a definition list!', function() {
 		const source = 'Term\n::> Definition 1\n';
 		const rendered = Markdown.render(source).trim();
-		expect(rendered, `Input:\n${source}`, { showPrefix: false }).toBe(`<dl><dt>Term</dt>\n<dd>> Definition 1</dd></dl>`);
+		expect(rendered, `Input:\n${source}`, { showPrefix: false }).toBe(`<dl><dt>Term</dt>\n<dd>&gt; Definition 1</dd></dl>`);
 	});
 
 	test('I am actually a two-term definition list!', function() {
 		const source = 'Term\n::> Definition 1\n::>> Definition 2';
 		const rendered = Markdown.render(source).trim();
-		expect(rendered, `Input:\n${source}`, { showPrefix: false }).toBe(`<dl><dt>Term</dt>\n<dd>> Definition 1</dd>\n<dd>>> Definition 2</dd></dl>`);
+		expect(rendered, `Input:\n${source}`, { showPrefix: false }).toBe(`<dl><dt>Term</dt>\n<dd>&gt; Definition 1</dd>\n<dd>&gt;&gt; Definition 2</dd></dl>`);
 	});
 });