Fix TOC labels for quoted HTML angle brackets

docs/changelog.md

@@ -16,6 +16,8 @@ See the [Contributing Guide](contributing.md) for details.
 
 ### Fixed
 
+* Strip complete HTML tags with quoted `>` characters from `toc` labels and
+  generated heading IDs.
 * Fix quadratic-time regex backtracking in `attr_list` when a block ends with an
   unclosed attribute list followed by a long run of spaces, e.g. a line
   consisting only of `{` and some text with many trailing spaces (#1656).

markdown/extensions/toc.py

@@ -24,6 +24,7 @@
 from ..util import parseBoolValue, AMP_SUBSTITUTE, deprecated, HTML_PLACEHOLDER_RE, AtomicString
 from ..treeprocessors import UnescapeTreeprocessor
 from ..serializers import RE_AMP
+from ..inlinepatterns import HTML_RE
 import re
 import html
 import unicodedata
@@ -108,8 +109,8 @@ def strip_tags(text: str) -> str:
     while (start := text.find('<!--')) != -1 and (end := text.find('-->', start)) != -1:
         text = f'{text[:start]}{text[end + 3:]}'
 
-    while (start := text.find('<')) != -1 and (end := text.find('>', start)) != -1:
-        text = f'{text[:start]}{text[end + 1:]}'
+    # Use the inline HTML pattern to respect quoted attribute values.
+    text = re.sub(HTML_RE, '', text, flags=re.DOTALL)
 
     # Collapse whitespace
     text = ' '.join(text.split())

tests/test_syntax/extensions/test_toc.py

@@ -155,6 +155,53 @@ def testTOCReset(self):
         self.assertEqual(md.toc, '')
         self.assertEqual(md.toc_tokens, [])
 
+    def testHTMLAttributeWithAngleBracket(self):
+        for quote in ['"', "'"]:
+            with self.subTest(quote=quote):
+                heading = f'<abbr title={quote}Python > 3{quote}>Python</abbr> support'
+                self.assertMarkdownRenders(
+                    f'# {heading}',
+                    f'<h1 id="python-support">{heading}</h1>',
+                    expected_attrs={
+                        'toc': (
+                            '<div class="toc">\n<ul>\n'
+                            '<li><a href="#python-support">Python support</a></li>\n'
+                            '</ul>\n</div>\n'
+                        ),
+                        'toc_tokens': [{
+                            'level': 1,
+                            'id': 'python-support',
+                            'name': 'Python support',
+                            'html': heading,
+                            'data-toc-label': '',
+                            'children': []
+                        }]
+                    }
+                )
+
+    def testCustomLabelAttributeWithAngleBracket(self):
+        label = '<abbr title="Python > 3">Python</abbr> &amp; support'
+        self.assertMarkdownRenders(
+            f"# Python support {{data-toc-label='{label}'}}",
+            '<h1 id="python-support">Python support</h1>',
+            expected_attrs={
+                'toc': (
+                    '<div class="toc">\n<ul>\n'
+                    '<li><a href="#python-support">Python &amp; support</a></li>\n'
+                    '</ul>\n</div>\n'
+                ),
+                'toc_tokens': [{
+                    'level': 1,
+                    'id': 'python-support',
+                    'name': 'Python &amp; support',
+                    'html': 'Python support',
+                    'data-toc-label': label,
+                    'children': []
+                }]
+            },
+            extensions=[TocExtension(), 'attr_list']
+        )
+
     def testUniqueIds(self):
         self.assertMarkdownRenders(
             self.dedent(
@@ -1454,6 +1501,18 @@ def testStripElementWithNewlines(self):
             'foo bar'
         )
 
+    def testStripElementWithQuotedBrackets(self):
+        for tag in [
+            '<abbr title="Python > 3">',
+            "<abbr title='Python > 3'>",
+            '<abbr title="3 < Python > 2">',
+            '<abbr title="Python\n> 3">',
+            '<abbr title="Python\'s > operator">',
+            "<abbr title='The \"greater than\" > operator'>",
+        ]:
+            with self.subTest(tag=tag):
+                self.assertEqual(strip_tags(f'foo {tag}bar</abbr>'), 'foo bar')
+
     def testStripComment(self):
         self.assertEqual(
             strip_tags('foo <!-- comment --> bar'),