#93 If we disable escape by default, will it still cause breaking changes?

Also, many helper might need refactor after this PR (for example, escape options in open_graph() helper can be removed):

https://github.com/hexojs/hexo/blob/bc474dca9331dd8f85579bf7c028b7b10b39c0b1/lib/plugins/helper/open_graph.js#L20

It's not safe to escape attributes when which value is url.
e.g.

data-url="http://example.com/"
=>
data-url="http://example.com/"

I left some comments on #93 .

Coverage remained the same at 96.491% when pulling dc4ba97 on curbengh:1.2.1 into 6155112 on hexojs:master.

#93 If we disable escape by default, will it still cause breaking changes?

no, but I encourage escape by default; meaning if users want to embed tag inside tag, they would have to opt out. Alternatively we could publish v1.3; v2 is too drastic though.

It's not safe to escape attributes when which value is url.

Fixed in #96 by detecting attribute if (i.includes('href') || i.includes('src') || i.includes('url')).

Alternative approach is to detect url url.parse(str).protocol but that doesn't cover /foo/bar. url.parse(str).pathname is not suitable because it covers all string.

Superseded by #99