GHSA-97jj-33gv-5xf9 league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

• Packagist league/commonmark: >= 1.3.0, < 2.10.2 → fixed in 2.10.2

## Summary The `DisallowedRawHtml` extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just `])/i ``` The trailing character class requires one character after the tag name. The block parser does not: `RegexHelper::PARTIAL_HTMLBLOCKOPEN` accepts end of line after a tag name, so ` ``` Output: ```html ``` A browser parses that as `` with a junk `` works the same way and does not need a later `` in the page. Control: `` is correctly escaped to `&lt;script src="/evil.js">&lt;/script>`. Affected versions 1.3.0 (when the extension was added) through the current release. The `]|$)/i', \implode('|', \array_map('preg_quote', $tags))); return \preg_replace($regex, '&lt;$1$2', $rendered); ``` This escapes every bypass shape above and leaves ``, `` and `` untouched. The existing unit test only covers tag names followed by another character, so a case for a bare tag name should be added.