encodeAmpsAndAngles runs after italicsAndBold, causing HTML parsing errors with angle brackets

[prabinbessie]

When Markdown content contains angle brackets (<) followed by numbers inside italic or bold formatting (e.g., <100.000), the HTML output becomes malformed

[tivie]

Thanks for the report. Confirmed, and after investigating it turns out to be broader than emphasis.

Reproduction

new showdown.Converter().makeHtml('_<100.000_');
// => "<p><em><100.000</em></p>"   (the < should be &lt;)

Plain text escapes correctly (text <100.000 becomes text <100.000); the problem only appears when the angle bracket sits inside certain inline constructs. It reproduces identically in the vanilla, github, and commonmark flavors, and it is long-standing (2.1.0 behaves the same). In the commonmark flavor it is also a spec deviation: the reference renders <em>&lt;100.000</em>.

Scope

The same leak affects every inline construct that hashes its own generated HTML during span parsing, for bare <, &, and >:

Construct	Result
emphasis / strong (all delimiter styles)	leaks raw
strikethrough	leaks raw
link text	leaks raw
link title	worse: the naked < breaks the generated <a> tag, corrupting the output
image alt	leaks into the alt="..." attribute

Not affected: plain text, code spans (which escape their own content), and the block containers (headings, blockquotes, list items) on their own. Those only show the problem when they contain one of the affected inline constructs, e.g. # _a <100_.

Root cause

The reporter's framing (ordering of encodeAmpsAndAngles versus emphasis) is close. The precise mechanism: emphasis, strikethrough, link and image all hash their generated HTML mid pipeline to protect it from later passes. That hashing hides any bare </&/> still sitting in the content, so the final encodeAmpsAndAngles pass never sees it and it is emitted raw. The link title and image alt cases are worse because the bare < lands inside the generated tag's attributes, so the tag-hashing regex cannot match the tag at all and the tag delimiters themselves get escaped.