Merge pull request #459 from sarathfrancis90/fix/markdown-renderer-link-title-quote

Escape quotes in MarkdownRenderer link and image titles

Author: lepture

src/mistune/renderers/markdown.py

@@ -32,7 +32,7 @@ def render_referrences(self, state: BlockState) -> Iterable[str]:
             text = "[" + attrs["label"] + "]: " + attrs["url"]
             title = attrs.get("title")
             if title:
-                text += ' "' + title + '"'
+                text += ' "' + _escape_title(title) + '"'
             yield text
 
     def render_children(self, token: Dict[str, Any], state: BlockState) -> str:
@@ -71,7 +71,7 @@ def link(self, token: Dict[str, Any], state: BlockState) -> str:
         else:
             out += url
         if title:
-            out += ' "' + title + '"'
+            out += ' "' + _escape_title(title) + '"'
         return out + ")"
 
     def image(self, token: Dict[str, Any], state: BlockState) -> str:
@@ -188,6 +188,13 @@ def table_cell(self, token: Dict[str, Any], state: BlockState) -> str:
         return _render_table_cell(self, token, state)
 
 
+def _escape_title(title: str) -> str:
+    """Escape a link/image title for emission inside double quotes. The closing
+    quote would otherwise end the title early on a re-parse; a backslash is
+    escaped first so it can't combine with the following character."""
+    return title.replace("\\", "\\\\").replace('"', '\\"')
+
+
 def _escape_block_prefix(text: str) -> str:
     """Backslash-escape a leading block marker on each line so that literal
     text is not re-parsed as a list, heading or block quote."""

tests/test_renderers.py

@@ -58,6 +58,18 @@ def test_codespan_containing_backticks(self):
         ):
             self.assert_round_trip(text)
 
+    def test_link_title_containing_quote(self):
+        # a double quote inside a link/image title must be escaped, or the
+        # re-parse closes the title early and drops it
+        for text in (
+            "[t](/u 'say \"hi\"')\n",
+            '[t](/u "say \\"hi\\"")\n',
+            "![a](/u 'say \"hi\"')\n",
+            "[t][r]\n\n[r]: /u 'say \"hi\"'\n",
+            '[t](/u "back\\\\slash \\" quote")\n',
+        ):
+            self.assert_round_trip(text)
+
     def test_real_markers_preserved(self):
         for text in (
             "* bullet\n",