use .toUpperCase() for link normalization

because __proto__ has magic and __PROTO__ doesn't

+ comments for the rest of ':' stuff

lib/helpers/normalize_reference.js

@@ -1,5 +1,8 @@
 'use strict';
 
 module.exports = function normalizeReference(str) {
-  return str.trim().replace(/\s+/g, ' ').toLowerCase();
+  // use .toUpperCase() instead of .toLowerCase()
+  // here to avoid a conflict with Object.prototype
+  // members (most notably, `__proto__`)
+  return str.trim().replace(/\s+/g, ' ').toUpperCase();
 };

lib/rules_core/abbr.js

@@ -32,6 +32,7 @@ function parseAbbr(str, parserInline, options, env) {
   title = str.slice(labelEnd + 2, pos).trim();
   if (title.length === 0) { return -1; }
   if (!env.abbreviations) { env.abbreviations = {}; }
+  // prepend ':' to avoid conflict with Object.prototype members
   if (typeof env.abbreviations[':' + label] === 'undefined') {
     env.abbreviations[':' + label] = title;
   }

lib/rules_core/footnote_tail.js

@@ -18,6 +18,7 @@ module.exports = function footnote_block(state) {
     }
     if (tok.type === 'footnote_reference_close') {
       insideRef = false;
+      // prepend ':' to avoid conflict with Object.prototype members
       refTokens[':' + currentLabel] = current;
       return false;
     }

lib/rules_core/references.js

@@ -58,8 +58,8 @@ function parseReference(str, parser, options, env) {
   if (pos < max && state.src.charCodeAt(pos) !== 0x0A) { return -1; }
 
   label = normalizeReference(str.slice(1, labelEnd));
-  if (typeof env.references[':' + label] === 'undefined') {
+  if (typeof env.references[label] === 'undefined') {
-    env.references[':' + label] = { title: title, href: href };
+    env.references[label] = { title: title, href: href };
   }
 
   return pos;

lib/rules_inline/links.js

@@ -120,7 +120,7 @@ module.exports = function links(state, silent) {
     // (collapsed reference link and shortcut reference link respectively)
     if (!label) { label = state.src.slice(labelStart, labelEnd); }
 
-    ref = state.env.references[':' + normalizeReference(label)];
+    ref = state.env.references[normalizeReference(label)];
     if (!ref) {
       state.pos = oldPos;
       return false;