fix: query parameter parsed as character entity

[bytestream]

Issue

See first commit for failing test case.

Before:

<a href="https://domain.com/page.php?foo=bar&target=baz">https://domain.com/page.php?foo=bar&target=baz</a>

After:

<a href="https://domain.com/page.php?foo=bar&amp;target=baz">https://domain.com/page.php?foo=bar&amp;⌖=baz</a>

Tokenizer logic

consumeData reads up to &target:

$this->text .= $this->scanner->charsUntil("<&\0");

On next iteration, & is detected as a character reference:

$tok = $this->scanner->current();

if ('&' === $tok) {
    // Character reference
    $ref = $this->decodeCharacterReference();

HTML spec

Input is valid HTML5 (https://validator.w3.org/#validate_by_input):

<a href="https://domain.com/page.php?foo=bar&target=baz">https://domain.com/page.php?foo=bar&target=baz</a>

https://www.w3.org/TR/html50/syntax.html#character-references states character references must always be terminated by ;. The current tokenizer only follows this logic for attributes.

[goetas]

This sounds legit. Thanks for providing the fix

[jshah4517]

@goetas thanks for merging this, would it be possible for a new release?

[jshah4517]

@goetas sorry to bump again, when you are free it would be great to have a new release so we can lock to it :-)

[goetas]

https://github.com/Masterminds/html5-php/releases/tag/2.7.4