decodeEntities unsafely decodes & when it results in a legacy character reference

[mathiasbynens]

The decodeEntities option decodes & even in cases when doing so changes the meaning (and rendering) of the resulting HTML.

Input HTML:

<pre><code>Label current;
// Load effective address of current instruction into rcx.
__ leaq(rcx, Operand(&amp;current));
__ bind(&amp;current);
</code></pre>

With decodeEntities: true, this gets minified into:

<pre><code>Label current;
// Load effective address of current instruction into rcx.
__ leaq(rcx, Operand(&current));
__ bind(&current);
</code></pre>

Note how &current (which renders as “&current”) is changed into &current (which renders as “¤t”). This should not happen since &curren (yes, even without the trailing ;) is a character reference for ¤, and so turning the & into just & changes the rendering/meaning.

The full list of such entities that do not require a closing ; (like &curren) is here: https://github.com/mathiasbynens/he/blob/master/data/decode-map-legacy.json (generated from the HTML Standard)

[mathiasbynens]

Patch: #965