From 7b71a62e404b0a4be7786e2199a3b58f9cb5c201 Mon Sep 17 00:00:00 2001
From: Garry Tan <garrytan@gmail.com>
Date: Fri, 14 Aug 2026 18:47:46 -0700
Subject: [PATCH] fix(make-pdf): stop URLs swallowing smartypants placeholders

A bare autolinked URL (<a href="X">X</a>) has zero whitespace between
the URL text and its own closing tag. TAG_RE carves that </a> into a
NUL-delimited SMARTPANTS_PRESERVED placeholder BEFORE the URL pass
runs, and URL_RE's \S+ swallowed the adjacent placeholder into the URL
match. The restore pass is single-shot, so the inner placeholder never
restored: raw "SMARTPANTS_PRESERVED_N" text leaked into the rendered
link, the </a> vanished, and link-blue styling bled into the rest of
the document (#2084). Excluding the NUL sentinel (\u0000) from the URL
character class stops the match from crossing into an already-carved
zone.

Contributed by @marshaung (PR #2280; PR #2339 by @BrendaB24 covered the
same smartypants defect).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 make-pdf/src/smartypants.ts  |  7 ++++++-
 make-pdf/test/render.test.ts | 28 ++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/make-pdf/src/smartypants.ts b/make-pdf/src/smartypants.ts
index 2dfe097e0..107817e3c 100644
--- a/make-pdf/src/smartypants.ts
+++ b/make-pdf/src/smartypants.ts
@@ -20,7 +20,12 @@
 
 const CODE_ZONE_RE = /<(pre|code|script|style)\b[^>]*>[\s\S]*?<\/\1>/gi;
 const TAG_RE = /<[^>]+>/g;
-const URL_RE = /\bhttps?:\/\/\S+/g;
+// \u0000 is the placeholder sentinel (see PLACEHOLDER below). It must be
+// excluded here: URLs are carved AFTER tags, so a URL sitting flush against
+// a tag (`<a href="...">https://ex.com</a>`) would otherwise let \S+ swallow
+// the placeholder standing in for `</a>` — that placeholder then never
+// restores (restore is a single pass) and the tag is lost.
+const URL_RE = /\bhttps?:\/\/[^\s\u0000]+/g;
 
 /**
  * Apply smartypants to an HTML string. Zones that should not be touched:
diff --git a/make-pdf/test/render.test.ts b/make-pdf/test/render.test.ts
index b54085ecb..a5a4d7f24 100644
--- a/make-pdf/test/render.test.ts
+++ b/make-pdf/test/render.test.ts
@@ -56,6 +56,34 @@ describe("smartypants", () => {
     expect(out).toContain("\u201cdetails\u201d");
   });
 
+  // A URL flush against a following tag (no whitespace between) used to let
+  // URL_RE's \S+ swallow the placeholder standing in for that tag. The
+  // placeholder never restored, so the tag vanished and its styling bled
+  // into the rest of the document. The test above misses this because its
+  // URL is followed by a space.
+  test("does not leak placeholders for a bare autolinked URL", () => {
+    const input = `<p>see <a href="https://ex.com">https://ex.com</a> ok</p>`;
+    const out = smartypants(input);
+    expect(out).not.toContain("SMARTPANTS_PRESERVED");
+    expect(out).toContain("</a>");
+    expect(out).toBe(input);
+  });
+
+  test("does not leak placeholders for a bold URL", () => {
+    const input = `<p>see <strong><a href="https://ex.com">https://ex.com</a></strong> ok</p>`;
+    const out = smartypants(input);
+    expect(out).not.toContain("SMARTPANTS_PRESERVED");
+    expect(out).toContain("</a></strong>");
+    expect(out).toBe(input);
+  });
+
+  test("does not leak placeholders when a URL is followed by punctuation", () => {
+    const input = `<p>see <a href="https://ex.com">https://ex.com</a>, ok</p>`;
+    const out = smartypants(input);
+    expect(out).not.toContain("SMARTPANTS_PRESERVED");
+    expect(out).toContain("</a>");
+  });
+
   test("does NOT touch HTML attribute values", () => {
     const out = smartypants(`<a href="it's-a-test.html">link</a>`);
     expect(out).toContain(`href="it's-a-test.html"`);