WIP feat(comark)!: drop entities dependency

packages/comark/package.json

@@ -68,7 +68,6 @@
     "release:dry": "release-it --dry-run"
   },
   "dependencies": {
-    "entities": "catalog:",
     "js-yaml": "catalog:",
     "markdown-exit": "catalog:"
   },

packages/comark/src/internal/parse/utils.ts

@@ -1,5 +1,6 @@
 import type { Node, ElementNode, ElementNodeAttributes, MarkdownDocument } from 'comark'
-import { decodeHTML, isHtmlVoidElement, TREE_WALK_MAX_DEPTH } from 'comark/utils'
+import { isHtmlVoidElement, TREE_WALK_MAX_DEPTH } from 'comark/utils'
+import { MarkdownExit } from 'markdown-exit'
 
 export type ParsedHtmlTag =
   | { kind: 'open'; tag: string; attrs: Record<string, unknown>; selfClosing: boolean }
@@ -181,6 +182,19 @@ export function parseHtmlInline(content: string): ParsedHtmlTag {
   return { kind: 'other', content: trimmed }
 }
 
+let unescapeAll: ((str: string) => string) | undefined
+
+/**
+ * Decode HTML entities in a raw attribute value with markdown-exit's entity table.
+ * `unescapeAll` also strips markdown backslash escapes, so backslashes are doubled
+ * first to keep them literal, as HTML attributes have no backslash escapes.
+ */
+function decodeAttributeValue(value: string): string {
+  if (!value.includes('&')) return value
+  unescapeAll ??= new MarkdownExit().utils.unescapeAll
+  return unescapeAll(value.replace(/\\/g, '\\\\'))
+}
+
 /**
  * Parse HTML attribute string into a key/value map.
  * Supports `key="value"`, `key='value'`, bare `key=value`, and boolean attributes.
@@ -195,7 +209,7 @@ export function parseHtmlAttributes(attrsStr: string): Record<string, unknown> {
   while ((match = re.exec(attrsStr)) !== null) {
     const key = match[1].toLowerCase()
     const value = match[2] ?? match[3] ?? match[4]
-    attrs[key] = value === undefined ? true : decodeHTML(value)
+    attrs[key] = value === undefined ? true : decodeAttributeValue(value)
   }
 
   return attrs

packages/comark/src/utils/index.ts

@@ -1,10 +1,7 @@
 // #region Tree Utils
 
-import { decodeHTML } from 'entities'
 import type { Node, MarkdownDocument } from 'comark'
 
-export { decodeHTML } from 'entities'
-
 type VisitResult = Node | false | undefined | void
 
 /**
@@ -18,21 +15,16 @@ export function isMarkdownDocument(value: unknown): value is MarkdownDocument {
  * Get the text content of a Markdown AST node
  *
  * @param node - The node
- * @param options - The options
- * @param options.decodeUnicodeEntities - Whether to decode Unicode entities
  * @returns The text content
  */
-export function textContent(node: Node, options: { decodeUnicodeEntities?: boolean } = {}): string {
+export function textContent(node: Node): string {
   if (typeof node === 'string') {
-    if (options.decodeUnicodeEntities) {
-      return decodeHTML(node)
-    }
-    return node as string
+    return node
   }
   let out = ''
   const len = node.length
   for (let i = 2; i < len; i++) {
-    out += textContent(node[i] as Node, options)
+    out += textContent(node[i] as Node)
   }
   return out
 }

packages/comark/test/html-escape.test.ts

@@ -39,6 +39,13 @@ describe('HTML attribute escaping', () => {
     expect(html).not.toContain('title="A "quote""')
   })
 
+  it('keeps backslashes literal while decoding HTML attribute entities', async () => {
+    const tree = await parseMarkdown('<span title="C:\\*dir\\ &amp; &copy;">hi</span>')
+    const p = tree.nodes[0] as [string, Record<string, unknown>, ...Node[]]
+    const span = (Array.isArray(p[2]) ? p[2] : p) as [string, Record<string, unknown>, ...Node[]]
+    expect(span[1].title).toBe('C:\\*dir\\ & ©')
+  })
+
   it('escapes quotes in component attribute props', async () => {
     const html = await renderHtml(`:span[hi]{title='a" onmouseover=alert(1) x="b'}`)
     expect(html).toContain('title="a&quot; onmouseover=alert(1) x=&quot;b"')

pnpm-workspace.yaml

@@ -90,7 +90,6 @@ catalog:
   comark: ^0.8.1
 
   # Core comark dependencies
-  entities: ^8.1.0
   github-slugger: ^2.0.0
   hast-util-to-string: ^3.0.1
   js-yaml: ^5.4.2