fix(timestamp): escape live table-cell pipe after an escaped backslash (#227)

escapeForTableCell used a `(?<!\\)\|` lookbehind that treated any pipe
preceded by a backslash as already escaped. The sequence `\\|` (an escaped
backslash followed by a genuinely live pipe) slipped through unescaped, so
the pipe stayed active and broke the markdown table row when a captured
timestamp landed in a table cell. Adjacent pipes (`||`) had the same class
of gap.

Key the escape on the parity of the preceding backslash run instead: a pipe
is already escaped only when it follows an odd-length run of backslashes, so
an even-length run (including zero) is escaped exactly once. This neutralizes
a pipe inside a table cell regardless of any preceding backslashes while
leaving genuinely-escaped pipes untouched.

Adds unit tests for the escaped-backslash-then-pipe (`a\\|b`), odd-run
(`a\\\|b`), and adjacent-pipe (`a||b`) cases.

Resolves deepsec finding other-escaping-gap-3d20dd1596.

Author: chhoumann

src/utility/prepareTimestampInsertion.test.ts

@@ -91,6 +91,24 @@ describe("escapeForTableCell", () => {
 		expect(escapeForTableCell("a \\| b")).toBe("a \\| b");
 	});
 
+	it("escapes a live pipe that follows an escaped backslash (\\\\|)", () => {
+		// `\\|` is an escaped backslash followed by a genuinely live pipe. A
+		// naive `(?<!\\)` lookbehind sees the backslash and skips the pipe,
+		// leaving it active and breaking the row. The even-length (2) backslash
+		// run means the pipe is live and must be escaped.
+		expect(escapeForTableCell("a\\\\|b")).toBe("a\\\\\\|b");
+	});
+
+	it("leaves a pipe escaped after an odd-length backslash run (\\\\\\|)", () => {
+		// Three backslashes = an escaped backslash plus an already-escaped pipe;
+		// the pipe must be left alone so the cell is never double-escaped.
+		expect(escapeForTableCell("a\\\\\\|b")).toBe("a\\\\\\|b");
+	});
+
+	it("escapes both of two adjacent live pipes", () => {
+		expect(escapeForTableCell("a||b")).toBe("a\\|\\|b");
+	});
+
 	it("collapses newlines (LF, CRLF, CR) to single spaces", () => {
 		expect(escapeForTableCell("line1\nline2")).toBe("line1 line2");
 		expect(escapeForTableCell("line1\r\nline2")).toBe("line1 line2");

src/utility/prepareTimestampInsertion.ts

@@ -80,9 +80,19 @@ export function isInsideTable(
  * space (a raw newline would end the row) and escape any unescaped pipe (a raw
  * pipe would open a new column). Already-escaped pipes (`\|`) are left alone so
  * the cell is never double-escaped.
+ *
+ * A pipe is "already escaped" only when it follows an odd-length run of
+ * backslashes; an even-length run (including zero) leaves the pipe live. Keying
+ * on the parity of the preceding backslash run - rather than the mere presence
+ * of one backslash - neutralizes pipes after an escaped backslash (`\\|`) and
+ * adjacent pipes (`||`), both of which a simple `(?<!\\)` lookbehind misses.
  */
 export function escapeForTableCell(text: string): string {
-	return text.replace(/\r\n?|\n/g, " ").replace(/(?<!\\)\|/g, "\\|");
+	return text
+		.replace(/\r\n?|\n/g, " ")
+		.replace(/(\\*)\|/g, (match, backslashes: string) =>
+			backslashes.length % 2 === 0 ? `${backslashes}\\|` : match,
+		);
 }
 
 /**