The default fenced-code-block renderer wrote attribute values from the
info string into the wrapper element without escaping. New converts each
value from a []byte to a string, so RenderAttributes' []byte escaping
branch was never reached and values were written verbatim; the class
value in writeDivStart was likewise unescaped. A quote in a value could
close the attribute and inject a further one, e.g. an event handler.
Escape string attribute values too, and escape the class value.
See CVE-2026-10618.
See #15247.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Goldmark v1.8 reports source positions in render hooks.
Use this to build a source map that translates Goldmark positions back to
the original content source.
Now all render hooks' context object implenent the `BaseContext` interface:
```go
type BaseContext interface {
Position() Position
Page() any
PageInner() any
Ordinal() int
}
```
Closes#14663
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bjørn Erik Pedersen