Merge pull request #1 from rsp/fix/xss_html_entities_semicolon

Optional semicolon in html entities regex
markedjs · Jul 15, 2016 · 0fa05b6 · 0fa05b6
2 parents 2cff859 + 31c7799
commit 0fa05b6
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/marked.js b/lib/marked.js
@@ -1095,7 +1095,7 @@ function escape(html, encode) {
 
 function unescape(html) {
 	// explicitly match decimal, hex, and named HTML entities 
-  return html.replace(/&(#(?:\d+)|(?:#x[0-9A-Fa-f]+)|(\w+))/g, function(_, n) {
+  return html.replace(/&(#(?:\d+)|(?:#x[0-9A-Fa-f]+)|(?:\w+));?/g, function(_, n) {
     n = n.toLowerCase();
     if (n === 'colon') return ':';
     if (n.charAt(0) === '#') {