fix(formatters): use backslash escapes for angle brackets, strip escape artifacts in autolinks

betegon · claude · betegon · commit aeb2e2ac89b0 · 2026-03-02T12:44:52.000+01:00
`escapeMarkdownInline` and `escapeMarkdownCell` were using HTML entities (`&lt;`/`&gt;`) to prevent `<tag>` from being parsed as HTML. But `marked` keeps entities as-is in text tokens, so `<unknown>` rendered literally as `&lt;unknown&gt;`. Switching to CommonMark backslash escapes (`\<`/`\>`) fixes this — `marked` emits them as `escape` tokens with the decoded char. Also fixes backslash-escaped underscores leaking into GFM autolinks. When a URL like `https://site.com/_astro/file.js` was escaped to `\_astro`, the GFM autolink detector captured the escaped form and preserved the backslash literally. Now `renderOneInline` detects autolinks via `link.raw` and strips escape artifacts from both the link text and href. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
diff --git a/src/lib/formatters/markdown.ts b/src/lib/formatters/markdown.ts
@@ -78,7 +78,7 @@ export function isPlainOutput(): boolean {
  * Escape a string for safe use inside a markdown table cell.
  *
  * Collapses newlines, escapes backslashes, pipes, and angle brackets.
- * Angle brackets must be escaped to `&lt;`/`&gt;` so that user-supplied
+ * Angle brackets are backslash-escaped (`\<`/`\>`) so that user-supplied
  * content (e.g. `Expected <string>`) is not parsed as an HTML tag by
  * `marked`, which would silently drop the content via `renderHtmlToken`.
  */
@@ -87,17 +87,17 @@ export function escapeMarkdownCell(value: string): string {
     .replace(/\n/g, " ")
     .replace(/\\/g, "\\\\")
     .replace(/\|/g, "\\|")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
+    .replace(/</g, "\\<")
+    .replace(/>/g, "\\>");
 }
 
 /**
  * Escape CommonMark inline emphasis characters.
  *
  * Prevents `_`, `*`, `` ` ``, `[`, `]`, `<`, and `>` from being consumed
- * by the parser. Angle brackets are HTML-escaped so that user-supplied
- * content (e.g. `Expected <string> got <number>`) is not silently dropped
- * when `marked` parses the text as HTML tokens.
+ * by the parser. Angle brackets are backslash-escaped (`\<`/`\>`) so that
+ * user-supplied content (e.g. `Expected <string> got <number>`) is not
+ * silently dropped when `marked` parses the text as HTML tokens.
  */
 export function escapeMarkdownInline(value: string): string {
   return value
@@ -107,8 +107,8 @@ export function escapeMarkdownInline(value: string): string {
     .replace(/`/g, "\\`")
     .replace(/\[/g, "\\[")
     .replace(/\]/g, "\\]")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
+    .replace(/</g, "\\<")
+    .replace(/>/g, "\\>");
 }
 
 /**
@@ -320,9 +320,19 @@ function renderOneInline(token: Token): string {
       return chalk.hex(COLORS.yellow)((token as Tokens.Codespan).text);
     case "link": {
       const link = token as Tokens.Link;
-      const linkText = renderInline(link.tokens);
+      let linkText = renderInline(link.tokens);
+      let href = link.href ?? "";
+      // GFM autolinks absorb backslash-escapes literally (\_astro → \_astro).
+      // Detect autolinks via link.raw (starts with URL, not "[") and strip artifacts.
+      const raw = link.raw ?? "";
+      if (raw.startsWith("http://") || raw.startsWith("https://")) {
+        const unescape = (s: string) =>
+          s.replace(/\\([_*`\[\]<>\\])/g, "$1");
+        linkText = unescape(linkText);
+        href = unescape(href);
+      }
       const styled = chalk.hex(COLORS.blue)(linkText);
-      return link.href ? terminalLink(styled, link.href) : styled;
+      return href ? terminalLink(styled, href) : styled;
     }
     case "del":
       return chalk.dim.gray.strikethrough(
diff --git a/test/lib/formatters/markdown.test.ts b/test/lib/formatters/markdown.test.ts
@@ -313,6 +313,10 @@ describe("escapeMarkdownCell", () => {
     const result = escapeMarkdownCell("a|b|c");
     expect(result).toBe("a\\|b\\|c");
   });
+
+  test("escapes angle brackets with backslash", () => {
+    expect(escapeMarkdownCell("<html>")).toBe("\\<html\\>");
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -479,6 +483,29 @@ describe("escapeMarkdownInline", () => {
   test("returns unchanged string with no special chars", () => {
     expect(escapeMarkdownInline("hello world")).toBe("hello world");
   });
+
+  test("escapes angle brackets with backslash", () => {
+    expect(escapeMarkdownInline("<unknown>")).toBe("\\<unknown\\>");
+  });
+
+  test("angle brackets survive round-trip through renderInlineMarkdown", () => {
+    withEnv({ SENTRY_PLAIN_OUTPUT: "0", NO_COLOR: undefined }, false, () => {
+      const escaped = escapeMarkdownInline("<unknown>");
+      const result = stripAnsi(renderInlineMarkdown(escaped));
+      expect(result).toBe("<unknown>");
+    });
+  });
+
+  test("URLs with underscores render without backslashes", () => {
+    withEnv({ SENTRY_PLAIN_OUTPUT: "0", NO_COLOR: undefined }, false, () => {
+      const escaped = escapeMarkdownInline(
+        "https://spotlightjs.com/_astro/ui-core.js"
+      );
+      const result = stripAnsi(renderInlineMarkdown(escaped));
+      expect(result).not.toContain("\\_");
+      expect(result).toContain("_astro");
+    });
+  });
 });
 
 // ---------------------------------------------------------------------------
