fix: escape HTML entities in link href and image src attributes

[madebysaira]

Summary

Fixes #4052

The renderer wrote cleanUrl(href) directly into href/ attributes without escaping & to &. This caused silent link-target corruption for URLs containing valid HTML entity sequences (<, &, ©, etc.).

The bug

marked('<https://example.com/?x=1&lt;2>')
// Actual:   href="...?x=1&lt;2"    (browser decodes to ...?x=1<2 — WRONG)
// Expected: href="...?x=1&amp;lt;2" (browser decodes to ...?x=1&lt;2 — CORRECT)

Any URL containing a valid entity sequence silently changes the link target. This also affects CommonMark example 595.

Root cause

Two issues:

1. Renderer — cleanUrl() runs encodeURI() which never encodes &, so the raw & reaches the HTML attribute unescaped.
2. Tokenizer — inline link destinations ([text](url)) kept HTML entities literal (& stayed as &), which is correct per CommonMark, but the renderer never escaped them on output.

Fix (2 parts)

1. Tokenizer (src/Tokenizer.ts) — Decode HTML entities in inline link destinations before rendering, per CommonMark spec (entity references are recognized in link destinations but not in autolinks).

2. Renderer (src/Renderer.ts) — Escape & → & in href/ attributes after cleanUrl(), ensuring valid HTML output.

3. Helper (src/helpers.ts) — Added decodeHtmlEntities() function for named/numeric character reference decoding.

Test results

• ✅ All 1783 CommonMark spec tests pass (no regressions)
• ✅ All 196 unit tests pass (including 5 new regression tests)
• ✅ CommonMark example 595 now produces correct output

Regression tests added

5 new test cases in test/unit/marked.test.js covering:

• Autolink with & (CommonMark example 595)
• Inline link with & entity
• Plain autolink URL with &
• Autolink with < entity
• Image with & in src

[vercel]

@madebysaira is attempting to deploy a commit to the MarkedJS Team on Vercel.

A member of the Team first needs to authorize it.

[UziTech]

This is already being fixed in #4053