fix: nunjucks/code blocks in HTML comments were incorrectly converted

lib/hexo/post.ts

@@ -13,9 +13,11 @@ import type { NodeJSLikeCallback, RenderData } from '../types';
 const preservedKeys = ['title', 'slug', 'path', 'layout', 'date', 'content'];
 
 const rHexoPostRenderEscape = /<hexoPostRenderCodeBlock>([\s\S]+?)<\/hexoPostRenderCodeBlock>/g;
+const rCommentEscape = /(<!--[\s\S]*?-->)/g;
 
 const rSwigPlaceHolder = /(?:<|&lt;)!--swig\uFFFC(\d+)--(?:>|&gt;)/g;
 const rCodeBlockPlaceHolder = /(?:<|&lt;)!--code\uFFFC(\d+)--(?:>|&gt;)/g;
+const rCommentHolder = /(?:<|&lt;)!--comment\uFFFC(\d+)--(?:>|&gt;)/g;
 
 const STATE_PLAINTEXT = Symbol('plaintext');
 const STATE_SWIG_VAR = Symbol('swig_var');
@@ -60,6 +62,14 @@ class PostRenderEscape {
     return str.replace(rCodeBlockPlaceHolder, PostRenderEscape.restoreContent(this.stored));
   }
 
+  restoreComments(str: string) {
+    return str.replace(rCommentHolder, PostRenderEscape.restoreContent(this.stored));
+  }
+
+  escapeComments(str: string) {
+    return str.replace(rCommentEscape, (_, content) => PostRenderEscape.escapeContent(this.stored, 'comment', content));
+  }
+
   escapeCodeBlocks(str: string) {
     return str.replace(rHexoPostRenderEscape, (_, content) => PostRenderEscape.escapeContent(this.stored, 'code', content));
   }
@@ -436,6 +446,8 @@ class Post {
       // Run "before_post_render" filters
       return ctx.execFilter('before_post_render', data, { context: ctx });
     }).then(() => {
+      // Escape all comments to avoid conflict with Nunjucks and code block
+      data.content = cacheObj.escapeComments(data.content);
       data.content = cacheObj.escapeCodeBlocks(data.content);
       // Escape all Nunjucks/Swig tags
       if (disableNunjucks === false) {
@@ -465,6 +477,7 @@ class Post {
       }, options);
     }).then(content => {
       data.content = cacheObj.restoreCodeBlocks(content);
+      data.content = cacheObj.restoreComments(data.content);
 
       // Run "after_post_render" filters
       return ctx.execFilter('after_post_render', data, { context: ctx });

test/scripts/hexo/post.ts

@@ -1452,4 +1452,62 @@ describe('Post', () => {
 
     data.content.should.eql('<a href="https://hexo.io/" title="tttitle" target="">foobar</a>');
   });
+
+  // https://github.com/hexojs/hexo/issues/5433
+  it('render() - nunjucks nesting in comments', async () => {
+    const content = [
+      'foo',
+      '<!--',
+      '{% raw %}',
+      'test',
+      '{% endraw %}',
+      '-->',
+      'bar'
+    ].join('\n');
+
+    const data = await post.render('', {
+      content,
+      engine: 'markdown'
+    });
+
+    data.content.should.eql([
+      '<p>foo</p>',
+      '<!--',
+      '{% raw %}',
+      'test',
+      '{% endraw %}',
+      '-->',
+      '<p>bar</p>',
+      ''
+    ].join('\n'));
+  });
+
+  // https://github.com/hexojs/hexo/issues/5433
+  it('render() - code fence nesting in comments', async () => {
+    const code = 'alert("Hello world")';
+    const highlighted = highlight(code);
+    const content = [
+      'foo',
+      '<!--',
+      '```',
+      code,
+      '```',
+      '-->',
+      'bar'
+    ].join('\n');
+
+    const data = await post.render('', {
+      content,
+      engine: 'markdown'
+    });
+
+    data.content.should.eql([
+      '<p>foo</p>',
+      '<!--',
+      `<hexoPostRenderCodeBlock>${highlighted}</hexoPostRenderCodeBlock>`,
+      '-->',
+      '<p>bar</p>',
+      ''
+    ].join('\n'));
+  });
 });