From 48e67fe05398dc4b1fca12db36c1b37bb341277a Mon Sep 17 00:00:00 2001
From: Tony Sullivan <tony.f.sullivan@outlook.com>
Date: Mon, 20 Jun 2022 19:09:35 +0000
Subject: [PATCH] Encode ampersands in markdown code blocks (#3630)

* encode ampersands in markdown code blocks

* chore: add changeset

* nit: fixing test case description
---
 .changeset/pink-pugs-beg.md                   |  5 ++++
 packages/markdown/remark/src/rehype-escape.ts |  2 +-
 .../markdown/remark/test/expressions.test.js  | 29 ++++++++++++++++++-
 3 files changed, 34 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/pink-pugs-beg.md

diff --git a/.changeset/pink-pugs-beg.md b/.changeset/pink-pugs-beg.md
new file mode 100644
index 0000000000..ee78d3d718
--- /dev/null
+++ b/.changeset/pink-pugs-beg.md
@@ -0,0 +1,5 @@
+---
+'@astrojs/markdown-remark': patch
+---
+
+Encodes ampersand characters in code blocks
diff --git a/packages/markdown/remark/src/rehype-escape.ts b/packages/markdown/remark/src/rehype-escape.ts
index a32027b89e..e776c1bb1b 100644
--- a/packages/markdown/remark/src/rehype-escape.ts
+++ b/packages/markdown/remark/src/rehype-escape.ts
@@ -8,7 +8,7 @@ export default function rehypeEscape(): any {
 				// Visit all raw children and escape HTML tags to prevent Markdown code
 				// like "This is a `<script>` tag" from actually opening a script tag
 				visit(el, 'raw', (raw) => {
-					raw.value = raw.value.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+					raw.value = raw.value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 				});
 			}
 			return el;
diff --git a/packages/markdown/remark/test/expressions.test.js b/packages/markdown/remark/test/expressions.test.js
index fdf5789239..0361e1df88 100644
--- a/packages/markdown/remark/test/expressions.test.js
+++ b/packages/markdown/remark/test/expressions.test.js
@@ -1,5 +1,5 @@
 import { renderMarkdown } from '../dist/index.js';
-import chai from 'chai';
+import chai, { expect } from 'chai';
 
 describe('expressions', () => {
 	it('should be able to serialize bare expression', async () => {
@@ -71,6 +71,33 @@ describe('expressions', () => {
 			);
 	});
 
+	it('should be able to encode ampersand characters in code blocks', async () => {
+		const { code } = await renderMarkdown(
+			'The ampersand in `&nbsp;` must be encoded in code blocks.',
+			{}
+		);
+
+		chai
+			.expect(code)
+			.to.equal(
+				'<p>The ampersand in <code is:raw>&amp;nbsp;</code> must be encoded in code blocks.</p>'
+			)
+	});
+
+	it('should be able to encode ampersand characters in fenced code blocks', async () => {
+		const { code } = await renderMarkdown(`
+		\`\`\`md
+			The ampersand in \`&nbsp;\` must be encoded in code blocks.
+		\`\`\`
+		`);
+
+		chai
+			.expect(code)
+			.to.match(
+				/^<pre is:raw.*<code>.*The ampersand in `&amp;nbsp;`/
+			);
+	})
+
 	it('should be able to serialize function expression', async () => {
 		const { code } = await renderMarkdown(
 			`{frontmatter.list.map(item => <p id={item}>{item}</p>)}`,