From 13e97eb56b747d67864471608f29aa9147a6a76a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=9A=D0=BE=D1=81=D1=82=D1=8F=20=D0=A2=D1=80=D0=B5=D1=82?=
 =?UTF-8?q?=D1=8F=D0=BA?= <ktretiak.in.ua@gmail.com>
Date: Tue, 2 Jan 2018 19:05:01 +0200
Subject: [PATCH] Fix auto_links secure Related to
 https://github.com/chjj/marked/pull/814

---
 lib/marked.js                                |  4 ++--
 test/tests/auto_links.html                   | 22 +++++++++++++++-----
 test/tests/auto_links.text                   | 21 ++++++++++++++-----
 test/tests/mangle_xss.sanatize.nomangle.html |  2 +-
 4 files changed, 36 insertions(+), 13 deletions(-)

diff --git a/lib/marked.js b/lib/marked.js
index 6f0e87c4c5..bf335fe074 100644
--- a/lib/marked.js
+++ b/lib/marked.js
@@ -445,9 +445,9 @@ Lexer.prototype.token = function(src, top, bq) {
 
 var inline = {
   escape: /^\\([\\`*{}\[\]()#+\-.!_>])/,
-  autolink: /^<([^ >]+(@|:\/)[^ >]+)>/,
+  autolink: /^<([^ <>]+(@|:\/)[^ <>]+)>/,
   url: noop,
-  tag: /^<!--[\s\S]*?-->|^<\/?\w+(?:"[^"]*"|'[^']*'|[^'">])*?>/,
+  tag: /^<!--[\s\S]*?-->|^<\/?\w+(?:"[^"]*"|'[^']*'|[^<'">])*?>/,
   link: /^!?\[(inside)\]\(href\)/,
   reflink: /^!?\[(inside)\]\s*\[([^\]]*)\]/,
   nolink: /^!?\[((?:\[[^\]]*\]|[^\[\]])*)\]/,
diff --git a/test/tests/auto_links.html b/test/tests/auto_links.html
index f8df9852c7..898fed622d 100644
--- a/test/tests/auto_links.html
+++ b/test/tests/auto_links.html
@@ -1,18 +1,30 @@
 <p>Link: <a href="http://example.com/">http://example.com/</a>.</p>
 
-<p>With an ampersand: <a href="http://example.com/?foo=1&amp;bar=2">http://example.com/?foo=1&amp;bar=2</a></p>
+<p>With an ampersand: <a href="http://example1.com/?foo=1&amp;bar=2">http://example1.com/?foo=1&amp;bar=2</a></p>
 
 <ul>
 <li>In a list?</li>
-<li><a href="http://example.com/">http://example.com/</a></li>
+<li><a href="http://example2.com/">http://example2.com/</a></li>
 <li>It should.</li>
 </ul>
 
 <blockquote>
-  <p>Blockquoted: <a href="http://example.com/">http://example.com/</a></p>
+  <p>Blockquoted: <a href="http://example3.com/">http://example3.com/</a></p>
 </blockquote>
 
-<p>Auto-links should not occur here: <code>&lt;http://example.com/&gt;</code></p>
+<p>Auto-links should not occur here: <code>&lt;http://example4.com/&gt;</code></p>
 
-<pre><code>or here: &lt;http://example.com/&gt;
+<pre><code>or here: &lt;http://example5.com/&gt;
 </code></pre>
+
+<p>Open angle bracket with link:</p>
+
+<p>&lt;<a href="http://example6.com">http://example6.com</a></p>
+
+<p>With space: &lt; <a href="http://example7.com">http://example7.com</a></p>
+
+<p>With content: &lt;1 <a href="http://example8.com">http://example8.com</a></p>
+
+<p>hello world
+<a href="http://example9.com">http://example9.com</a>
+</p>
diff --git a/test/tests/auto_links.text b/test/tests/auto_links.text
index f85767b48a..7a017f00ae 100644
--- a/test/tests/auto_links.text
+++ b/test/tests/auto_links.text
@@ -1,13 +1,24 @@
 Link: <http://example.com/>.
 
-With an ampersand: <http://example.com/?foo=1&bar=2>
+With an ampersand: <http://example1.com/?foo=1&bar=2>
 
 * In a list?
-* <http://example.com/>
+* <http://example2.com/>
 * It should.
 
-> Blockquoted: <http://example.com/>
+> Blockquoted: <http://example3.com/>
 
-Auto-links should not occur here: `<http://example.com/>`
+Auto-links should not occur here: `<http://example4.com/>`
 
-	or here: <http://example.com/>
+	or here: <http://example5.com/>
+
+Open angle bracket with link:
+
+<<http://example6.com>
+
+With space: < <http://example7.com>
+
+With content: <1 <http://example8.com>
+
+hello world
+<http://example9.com>
diff --git a/test/tests/mangle_xss.sanatize.nomangle.html b/test/tests/mangle_xss.sanatize.nomangle.html
index 9f87f09a43..83a7b355d6 100644
--- a/test/tests/mangle_xss.sanatize.nomangle.html
+++ b/test/tests/mangle_xss.sanatize.nomangle.html
@@ -1,3 +1,3 @@
-<p><a href="mailto:&lt;svg/onload=&quot;alert(1)&quot;//@x">&lt;svg/onload=&quot;alert(1)&quot;//@x</a></p>
+<p>&lt;<a href="mailto:svg/onload=&quot;alert(1)&quot;//@x">svg/onload=&quot;alert(1)&quot;//@x</a></p>
 
 <p><a href="mailto:bar&quot;onclick=&quot;alert(&#39;XSS&#39;)&quot;@foo">bar&quot;onclick=&quot;alert(&#39;XSS&#39;)&quot;@foo</a></p>