Fix #9788: only allow colon-separator named params with strict identifiers (#9791)

The reAttributeName regexp in parseMacroParameterAsAttribute was too
permissive, allowing single-character names like dollar sign followed by
colon. This caused values such as dollar-colon-slash-plugins-foo to be
mis-parsed as a named parameter dollar with value slash-plugins-foo.

Fix: when the separator is colon (legacy syntax), require the parameter
name to match [A-Za-z0-9-_]+ (same as the historic parseMacroParameter).
When the separator is equals (new-style dynamic parameters from #9055),
the wide character set is preserved so that names like double-dollar-one
continue to work.

Adds regression test Transclude/Procedures/Dollar/Param.

core/modules/parsers/parseutils.js

@@ -326,6 +326,7 @@ exports.parseMacroParameterAsAttribute = function(source,pos) {
 	};
 	// Define our regexps
 	var reAttributeName = /([^\/\s>"'`=:]+)/y,
+		reStrictIdentifier = /^[A-Za-z0-9\-_]+$/,
 		reUnquotedAttribute = /((?:(?:>(?!>))|[^\s>"'])+)/y,
 		reFilteredValue = /\{\{\{([\S\s]+?)\}\}\}/y,
 		reIndirectValue = /\{\{([^\}]+)\}\}/y,
@@ -337,6 +338,11 @@ exports.parseMacroParameterAsAttribute = function(source,pos) {
 		namePos = nameToken && $tw.utils.skipWhiteSpace(source,nameToken.end),
 		separatorToken = nameToken && $tw.utils.parseTokenRegExp(source,namePos,/=|:/y),
 		isNewStyleSeparator = false; // If there is no separator then we don't allow new style values
+	// Colon separator requires a strict identifier name to avoid mis-parsing values like $:/foo
+	if(nameToken && separatorToken && separatorToken.match[0] === ":" && !reStrictIdentifier.test(nameToken.match[1])) {
+		nameToken = null;
+		separatorToken = null;
+	}
 	// If we have a name and a separator then we have a named attribute
 	if(nameToken && separatorToken) {
 		node.name = nameToken.match[1];

editions/test/tiddlers/tests/data/transclude/Procedures-Dollar-Param.tid

@@ -0,0 +1,22 @@
+title: Transclude/Procedures/Dollar/Param
+description: Procedure call with unquoted parameter containing dollar-colon ($:) prefix should not be parsed as a named parameter
+type: text/vnd.tiddlywiki-multiple
+tags: [[$:/tags/wiki-test-spec]]
+
+title: Output
+
+\whitespace trim
+\procedure test(a, b)
+<<a>>--<<b>>
+\end
+
+<<test 1 2>>
+
+<<test 1 $:/foo>>
+
+<<test $:/foo $:/bar>>
+
++
+title: ExpectedResult
+
+<p>1–2</p><p>1–<a class="tc-tiddlylink tc-tiddlylink-missing" href="#%24%3A%2Ffoo">$:/foo</a></p><p><a class="tc-tiddlylink tc-tiddlylink-missing" href="#%24%3A%2Ffoo">$:/foo</a>–<a class="tc-tiddlylink tc-tiddlylink-missing" href="#%24%3A%2Fbar">$:/bar</a></p>