The original Markdown implementation (and probably all its ports, including Showdown and MarkdownSharp) basically uses this regular expression to find HTML comments:
This boils down to
which is bound for catastrophe. Granted, the HTML4 definition of comments isn't very helpful when it comes to specifying what precisely constitues a comment:
HTML comments have the following syntax:
<!-- this is a comment -->
<!-- and so is this one,
which occupies more than one line -->
White space is not permitted between the markup declaration open delimiter("<!") and the comment open delimiter ("--"), but is permitted between the comment close delimiter ("--") and the markup declaration close delimiter (">"). A common error is to include a string of hyphens ("---") within a comment. Authors should avoid putting two or more adjacent hyphens inside comments.
– that's like defining a carnivore using a picture of a cat, with a footnote stating that there may be versions with more than four legs.
The HTML5 definition is much better:
Comments consist of the following parts, in exactly the following order:
- the comment start delimiter "<!--"
- the comment end delimiter "-->"
The text part of comments has the following restrictions:
- must not start with a ">" character
- must not start with the string "->"
- must not contain the string "--"
- must not end with a "-" character
– and also lends itself to a much safer regular expression:
(note this is only 99% correct, because it considers
<!------> a valid comment, which it isn't – but that's the only deviance, and not really a real-life problem).
So from now on, that's what we'll be using. It should be mentioned that while a
> is a valid character in a comment from both the W3C specification and the above Regex, it's not going to work correctly in our Markdown, because the tag sanitizer will eat it:
<!-- love > hate -->
Anyone running Markdown on their site should take a look at their implementation; while they don't have to use the above change, replacing the original Regex with something safer might be in order.