fix: only HTML-escape codespan in HTML render

src/mistune/inline_parser.py

@@ -19,7 +19,7 @@
     parse_link_text,
     unescape_char,
 )
-from .util import escape, escape_url, unikey
+from .util import escape_url, unikey
 
 PAREN_END_RE = re.compile(r'\s*\)')
 
@@ -310,7 +310,7 @@ def parse_codespan(self, m: Match[str], state: InlineState) -> int:
             if len(code.strip()):
                 if code.startswith(' ') and code.endswith(' '):
                     code = code[1:-1]
-            state.append_token({'type': 'codespan', 'raw': escape(code)})
+            state.append_token({'type': 'codespan', 'raw': code})
             return end_pos
         else:
             state.append_token({'type': 'text', 'raw': marker})

src/mistune/renderers/html.py

@@ -91,7 +91,7 @@ def image(self, text: str, url: str, title: Optional[str] = None) -> str:
         return s + ' />'
 
     def codespan(self, text: str) -> str:
-        return '<code>' + text + '</code>'
+        return '<code>' + escape_text(text) + '</code>'
 
     def linebreak(self) -> str:
         return '<br />\n'

tests/test_misc.py

@@ -77,7 +77,7 @@ def test_markdown_func(self):
 
     def test_ast_output(self):
         md = mistune.create_markdown(escape=False, renderer=None)
-        text = '# h1\n\nfoo **bar**'
+        text = '# h1\n\nfoo **bar**\n\n`&<>"`'
         result = md(text)
         expected = [
             {
@@ -94,6 +94,13 @@ def test_ast_output(self):
                     {'type': 'strong', 'children': [{'type': 'text', 'raw': 'bar'}]}
                 ]
             },
+            {'type': 'blank_line'},
+            {
+                'type': 'paragraph',
+                'children': [
+                    {'type': 'codespan', 'raw': '&<>"'},
+                ]
+            },
         ]
         self.assertEqual(result, expected)