fix: escape passthrough tags in rendered attributes

[pchuri]

Intent

Fix the passthrough-tag attribute-escaping defect in confluence-cli's markdown->storage converter (roadmap #2, conf-passthrough-attresc-p2). lib/macro-converter.js stashes allow-listed inline tags (br|u|sub|sup|mark|details|summary) as placeholders before markdown rendering and restores them globally across the whole rendered HTML string. When a placeholder rendered into a link/image title attribute, the raw tag was restored verbatim, injecting unescaped <>"& into an attribute value and producing storage XML that Confluence rejects. The captain approved a SINGLE root-fix scope (S), NOT a broad pipeline sweep: fix only this defect, covering all seven allow-listed tags at once, and keep body-text passthrough byte-identical. Approach: at restore time detect the attribute context (nearest preceding angle bracket opens a tag: last '<' after last '>' before the placeholder offset) and XML-escape the restored value via a new escapeXmlAttr helper (& first, then < > "); text-node placeholders stay raw so body output is unchanged. Added 5 regression tests (link title
, image title _{, mixed body+title, all-seven-tags, well-formed-XML assertion). Deliberately did NOT expand into other pipeline areas (#210/#213/#215, admonitions, link rewriting) - that broader sweep was explicitly out of scope. Full suite 851 pass, lint clean. fix: type for patch release via semantic-release.}

What Changed

• Escape restored passthrough tags inside link and image title attributes while preserving raw tags in body text.
• Track tag context with a forward cursor for linear-time placeholder restoration.
• Add regression coverage for mixed contexts, all seven allowed tags, and well-formed XML output.

Risk Assessment

✅ Low: The follow-up removes the quadratic scan while preserving the required attribute-context detection and unchanged body passthrough behavior.

Testing

Targeted regressions, all 851 repository tests, actual CLI conversion, strict XML parsing, and base-versus-target body parity passed; evidence shows all-seven title escaping, embedded quote/ampersand escaping, and byte-identical body passthrough.

Evidence: Generated Confluence storage XML

<p>Body H<sub>2</sub>O, <u>under</u>, <mark>highlight</mark>, x<sup>2</sup>, line<br />break.</p>
<p><a href="https://example.com" title="before&lt;br&gt;&lt;u&gt;&lt;sub&gt;&lt;sup&gt;&lt;mark&gt;&lt;details&gt;&lt;summary&gt;after">all seven</a></p>
<p><a href="https://example.com" title="&lt;mark data-x=&quot;A&amp;B&quot;&gt;">attribute chars</a></p>

Evidence: Base/target body parity

body_passthrough_byte_identical=true
base_bytes=247 target_bytes=247
base_sha256=57bf12897bcd913262d29f79fbfde7b0b026e51e3e2885c3995073894170bd5d
target_sha256=57bf12897bcd913262d29f79fbfde7b0b026e51e3e2885c3995073894170bd5d

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• ⚠️ lib/macro-converter.js:155 - Each placeholder rescans the entire preceding HTML, making restoration O(n²) when passthrough-tag count scales with document size. Track tag context with a forward cursor so each character is scanned once.

🔧 Fix: Optimize passthrough placeholder context scanning
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• Reviewed git diff 088011cd02fb454023b156f601697471ad1b0907..b869b1ba9dc75f07904163d90a82bba97e9670a7
• npx jest tests/macro-converter.test.js --runInBand --testNamePattern='passthrough tags in link/image title attributes|<br> passthrough|<u>/<sub>/<sup>/<mark> passthrough'
• Piped mixed body/title Markdown through node bin/confluence.js convert --input-format markdown --output-format storage --output-file /var/folders/mm/mzvsb9xn40vd3pqkp4y8n_sm0000gn/T/no-mistakes-evidence/01KY7PSSSVT3P34GFPFAW2911A/passthrough-attribute-escaping.storage.xml
• Wrapped the generated fragment in <root> and ran xmllint --noout -
• Compared all-seven body output from the base and target converters byte-for-byte and by SHA-256
• npm test -- --runInBand

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[github-actions]

🎉 This PR is included in version 2.19.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀