From 0f947550a2d093b8490da949def8fc7ba4fdbc7a Mon Sep 17 00:00:00 2001
From: Michael Howell <michael@notriddle.com>
Date: Sat, 27 Jan 2024 14:34:22 -0700
Subject: [PATCH] Do not process `&`-entities that don't end in `;`

Fixes #278
---
 lib/common.js       |  4 ++--
 lib/inlines.js      |  4 ++--
 test/regression.txt | 13 +++++++++++++
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/lib/common.js b/lib/common.js
index dd8f6984..9d9cfe65 100644
--- a/lib/common.js
+++ b/lib/common.js
@@ -1,7 +1,7 @@
 "use strict";
 
 import encode from "mdurl/encode.js";
-import { decodeHTML } from "entities";
+import { decodeHTMLStrict } from "entities";
 
 var C_BACKSLASH = 92;
 
@@ -58,7 +58,7 @@ var unescapeChar = function(s) {
     if (s.charCodeAt(0) === C_BACKSLASH) {
         return s.charAt(1);
     } else {
-        return decodeHTML(s);
+        return decodeHTMLStrict(s);
     }
 };
 
diff --git a/lib/inlines.js b/lib/inlines.js
index 501a251f..83f08a69 100644
--- a/lib/inlines.js
+++ b/lib/inlines.js
@@ -3,7 +3,7 @@
 import Node from "./node.js";
 import * as common from "./common.js";
 import fromCodePoint from "./from-code-point.js";
-import { decodeHTML } from "entities";
+import { decodeHTMLStrict } from "entities";
 import "string.prototype.repeat"; // Polyfill for String.prototype.repeat
 
 var normalizeURI = common.normalizeURI;
@@ -773,7 +773,7 @@ var removeBracket = function() {
 var parseEntity = function(block) {
     var m;
     if ((m = this.match(reEntityHere))) {
-        block.appendChild(text(decodeHTML(m)));
+        block.appendChild(text(decodeHTMLStrict(m)));
         return true;
     } else {
         return false;
diff --git a/test/regression.txt b/test/regression.txt
index 48ba72a3..da235fb2 100644
--- a/test/regression.txt
+++ b/test/regression.txt
@@ -471,3 +471,16 @@ x <- 1
 <pre><code class="language-r">x &lt;- 1
 </code></pre>
 ````````````````````````````````
+
+#278
+```````````````````````````````` example
+&parag;
+
+&para
+
+&para;
+.
+<p>&amp;parag;</p>
+<p>&amp;para</p>
+<p>¶</p>
+````````````````````````````````