showdownjs / showdown

A bidirectional Markdown to HTML to Markdown converter written in Javascript
http://www.showdownjs.com/
MIT License
14.1k stars 1.57k forks source link

Nonstandard HTML comment endings #971

Open hohMiyazawa opened 1 year ago

hohMiyazawa commented 1 year ago

Current Firefox and Chromium accept --!> as endings for HTML comments.

This is nonstandard, as HTML comments should end with -->. The standard does however disallow --!> inside comment strings, and as such, browsers are lenient and accept it as a comment ending anyway.

HTML comments are detected with a regex here, only matching -->:

https://github.com/showdownjs/showdown/blob/95255984ad80acf745ed74605bd3ad8357dc9b33/dist/showdown.js#L3566

This potentially causes a mismatch between visible and invisible page content.