Commit `ede847ef53`

ede847ef533caabe59ee413b870879ff3728e31d

parent: 8c99ef194e

Unsigned

cmc <hello@cleberg.net> · 2026-07-16 00:29 UTC

fix: render code span contents literally

processInline protected allowlisted HTML tags before it handled code spans, so
a `<b>` written inside backticks was carried through as a live tag and applied
formatting instead of rendering as text. Every other inline pass ran against
code span contents for the same reason, so `**x**` in backticks was emitted as
bold.

Protect code spans first with their contents escaped, which takes them out of
reach of the tag, emphasis, and link passes.

Layout: unified · split

Hutch/Views/Repositories/ReadmeView.swift +13 −7

 ) -> String {
     var protectedFragments: [String: String] = [:]
+    // Code spans render their contents literally, so they have to be taken out of
+    // the text before any later pass can treat those contents as markup — the tag
+    // pass below would otherwise promote an allowlisted `<b>` into a live tag.
     var result = protectMatches(
         in: text,
+        pattern: #"`([^`]+)`"#,
+        protectedFragments: &protectedFragments
+    ) { match, nsText in
+        let code = nsText.substring(with: match.range(at: 1))
+        return "<code>\(escapeHTML(code))</code>"
+    }
+    result = protectMatches(
+        in: result,
         pattern: #"</?[A-Za-z][^>]*?>"#,
         protectedFragments: &protectedFragments
     ) { match, nsText in
         with: "<em>$1</em>",
         options: .regularExpression
     )
-    // Inline code: `text`
-    result = result.replacingOccurrences(
-        of: #"`([^`]+)`"#,
-        with: "<code>$1</code>",
-        options: .regularExpression
-    )
     for (token, fragment) in protectedFragments {
         result = result.replacingOccurrences(of: token, with: fragment)
     }

Commit ede847ef53

Commit `ede847ef53`