Merge #4017 into stage-mk

static/ui.js

@@ -3763,10 +3763,22 @@ function renderMd(raw){
       return false;
     }
   }
+  function _isSafeLabelInline(tag){
+    return /^<\/?(strong|em|del|code)([\s>]|$)/i.test(tag);
+  }
+  function _markdownLabelHtml(label){
+    const _label_stash=[];
+    const tokenized=String(label||'').replace(/<\/?[a-z][^>]*>/gi,tag=>{
+      if(!_isSafeLabelInline(tag)) return tag;
+      _label_stash.push(tag);
+      return `\x00H${_label_stash.length-1}\x00`;
+    });
+    return esc(tokenized).replace(/\x00H(\d+)\x00/g,(_,i)=>_label_stash[+i]);
+  }
   function _markdownAnchor(label,rawUrl){
     const href=_markdownHref(rawUrl);
     const internal=/^session:\/\//i.test(String(rawUrl||'')) || _isInternalSessionHref(href);
-    return `<a${internal?' class="session-link"':''} href="${href}"${internal?'':' target="_blank" rel="noopener"'}>${esc(label)}</a>`;
+    return `<a${internal?' class="session-link"':''} href="${href}"${internal?'':' target="_blank" rel="noopener"'}>${_markdownLabelHtml(label)}</a>`;
   }
   function _isSafeUrl(v, img){
     const raw=_safeAttrValue(v);

tests/test_issue4001_inline_code_link_label.py

@@ -0,0 +1,24 @@
+pytest_plugins = ("tests.test_renderer_js_behaviour",)
+
+from tests.test_renderer_js_behaviour import _render
+
+
+def test_inline_code_inside_link_label_renders_as_code(driver_path):
+    out = _render(driver_path, "[`8c64957`](https://github.com/x/y)")
+    assert '<a href="https://github.com/x/y"' in out
+    assert "<code>8c64957</code>" in out
+    assert "&lt;code&gt;" not in out
+
+
+def test_list_item_link_label_keeps_inline_code(driver_path):
+    out = _render(driver_path, "- [`8c64957`](https://github.com/x/y)")
+    assert "<li>" in out
+    assert "<code>8c64957</code>" in out
+    assert "&lt;code&gt;" not in out
+
+
+def test_unknown_raw_html_inside_link_label_is_escaped_once(driver_path):
+    out = _render(driver_path, "[<script>alert(1)</script>](https://github.com/x/y)")
+    assert "<script>" not in out
+    assert "&lt;script&gt;alert(1)&lt;/script&gt;" in out
+    assert "&amp;lt;script" not in out