Markdown: Fixed markdown not working in NodeJS

[RunDevelopment]

Markdown crashed on Node. The code-block-highlighting relyed on browser DOM to get the text content of an HTML string (see wrap hook function).

The fix employed by this PR is to replace the DOM-based approach with a custom function: textcontent(html: string). The function is implemented using Prism's markup tag regex and some custom logic to unescape HTML entities I stole (not literally) from lowdash. It works pretty well on Node and in browsers (notably IE11).

I also contemplated detecting whether we have DOM access and using the DOM approach when available. I decided against this because:

1. Consistent behavior. Markdown working just fine in the browser but not on NodeJS is exactly what I tried to fix.
2. Security. It's unexpected that Markdown inserts anything into the DOM. This might open the door for XSS attacks.

---

@mAAdhaTTah @LeaVerou @Golmote

This fix is urgent. Please review ASAP.

I want to release the fix right after it got merged.

---

This fixes #2973.

[github-actions]

JS File Size Changes (gzipped)

A total of 1 files have changed, with a combined diff of +166 B (+9.2%).

file	master	pull	size diff	% diff
components/prism-markdown.min.js	1.8 KB	1.97 KB	+166 B	+9.2%

Generated by 🚫 dangerJS against 59e320a

[LeaVerou]

This is not a regression, right? If not, why is it urgent?

[RunDevelopment]

It is a regression. Markdown doesn't work on Node anymore. See #2973 and #2976.

[LeaVerou]

What introduced this regression? git blame shows that these lines have existed for 5 months?

[RunDevelopment]

The linked commit did introduce the regression. We just haven't had a release for 6 months, so it went unnoticed.

[LeaVerou]

I see. I'm not a huge fan of stripping HTML with regexes (it worries me about potential security issues or incorrect results) but I suppose our best bet is to merge this in and remove the regression as soon as possible, while we figure out a better long-term fix.

[RunDevelopment]

I'm not a huge fan of stripping HTML with regexes

Neither am I.

I'll open a separate issue for a sound way to get the text content of an HTML string.

[RunDevelopment]

@LeaVerou, can I take your comment as approval? Just want to make sure :)

I plan on releasing a patch right after merging this.

[RunDevelopment]

Actually, I want the patch to include a fix for #2974 as well.

[meteorlxy]

@RunDevelopment If #2974 could not be merged soon, would you mind to release a patch for this fix first?

[RunDevelopment]

@meteorlxy v1.24.1 is now available. It includes both fixes.