fix(parser): restore multiline code spans

README.md

@@ -110,6 +110,9 @@ The `tables` extra supports code spans delimited by single or multiple backticks
 including an operator cell such as ```` ``|`` ````. A pipe immediately after the
 closing delimiter separates the next cell.
 
+Inline code spans can wrap onto the next line in hard-wrapped text. The
+line ending remains inside the generated `<code>` element.
+
 There are a number of currently implemented extras for tables, footnotes,
 syntax coloring of `<pre>`-blocks, auto-linking patterns, table of contents,
 Smarty Pants (for fancy quotes, dashes, etc.) and more. See the [Extras

lib/markdown2.py

@@ -1468,7 +1468,7 @@ def _is_comment(token):
         code_hashes = {}
         lt_hash = _hash_text('<')
         self._code_table['<'] = lt_hash
-        text = self._code_span_re.sub(
+        text = self._safe_mode_code_span_re.sub(
             lambda m: self._hash_span(m.group(0).replace('<', lt_hash), code_hashes),
             text
         )
@@ -2119,7 +2119,10 @@ def _do_code_blocks(self, text: str) -> str:
             (?<!`)
             \1          # Matching closer
             (?!`)
-        ''', re.X)
+        ''', re.X | re.S)
+    # Later block parsing can split multiline spans (e.g. link definitions).
+    # Let safe mode sanitize HTML in them before the span gamut runs.
+    _safe_mode_code_span_re = re.compile(_code_span_re.pattern, re.X)
 
     def _code_span_sub(self, match: re.Match[str]) -> str:
         c = match.group(2).strip(" \t")

test/test_markdown2.py

@@ -249,6 +249,19 @@ def test_footnote_numbers_reset_between_conversions(self):
         self.assertIn('<a href="#fn-second">1</a>', html)
         self.assertIn('<li id="fn-second">', html)
 
+    def test_multiline_code_spans(self):
+        for safe_mode in (None, "escape", "replace"):
+            with self.subTest(safe_mode=safe_mode):
+                self.assertEqual(
+                    markdown2.markdown("Call the `foo\nbar()` function.",
+                                       safe_mode=safe_mode),
+                    "<p>Call the <code>foo\nbar()</code> function.</p>\n")
+
+    def test_multiline_code_span_does_not_hide_link_definition_html(self):
+        source = '`\n<img src onerror="alert(origin)">\n[x]: `'
+        self.assertEqual(markdown2.markdown(source, safe_mode="replace"),
+                         "<p>`\n[HTML_REMOVED]</p>\n")
+
     def test_many_distinct_code_spans(self):
         source = '\n\n'.join('`value_%s`' % i for i in range(1000))
         expected = '\n\n'.join('<p><code>value_%s</code></p>' % i for i in range(1000)) + '\n'