--- mistune-0.7.2/mistune.py.O	2017-12-28 17:53:11.810066149 +0200
+++ mistune-0.7.2/mistune.py	2017-12-28 17:55:21.674677624 +0200
@@ -31,41 +31,42 @@
     'a', 'em', 'strong', 'small', 's', 'cite', 'q', 'dfn', 'abbr', 'data',
     'time', 'code', 'var', 'samp', 'kbd', 'sub', 'sup', 'i', 'b', 'u', 'mark',
     'ruby', 'rt', 'rp', 'bdi', 'bdo', 'span', 'br', 'wbr', 'ins', 'del',
     'img', 'font',
 ]
 _pre_tags = ['pre', 'script', 'style']
 _valid_end = r'(?!:/|[^\w\s@]*@)\b'
 _valid_attr = r'''"[^"]*"|'[^']*'|[^'">]'''
 _block_tag = r'(?!(?:%s)\b)\w+%s' % ('|'.join(_inline_tags), _valid_end)
 _scheme_blacklist = ('javascript', 'data', 'vbscript')
 
 
 def _pure_pattern(regex):
     pattern = regex.pattern
     if pattern.startswith('^'):
         pattern = pattern[1:]
     return pattern
 
 
 def _keyify(key):
-    return _key_pattern.sub(' ', key.lower())
+    key = escape(key.lower(), quote=True)
+    return _key_pattern.sub(' ', key)
 
 
 def escape(text, quote=False, smart_amp=True):
     """Replace special characters "&", "<" and ">" to HTML-safe sequences.
 
     The original cgi.escape will always escape "&", but you can control
     this one for a smart escape amp.
 
     :param quote: if set to True, " and ' will be escaped.
     :param smart_amp: if set to False, & will always be escaped.
     """
     if smart_amp:
         text = _escape_pattern.sub('&amp;', text)
     else:
         text = text.replace('&', '&amp;')
     text = text.replace('<', '&lt;')
     text = text.replace('>', '&gt;')
     if quote:
         text = text.replace('"', '&quot;')
         text = text.replace("'", '&#39;')
@@ -431,41 +432,42 @@
                 'extra': attr,
                 'text': text
             })
 
     def parse_paragraph(self, m):
         text = m.group(1).rstrip('\n')
         self.tokens.append({'type': 'paragraph', 'text': text})
 
     def parse_text(self, m):
         text = m.group(0)
         self.tokens.append({'type': 'text', 'text': text})
 
 
 class InlineGrammar(object):
     """Grammars for inline level tokens."""
 
     escape = re.compile(r'^\\([\\`*{}\[\]()#+\-.!_>~|])')  # \* \+ \! ....
     inline_html = re.compile(
         r'^(?:%s|%s|%s)' % (
             r'<!--[\s\S]*?-->',
-            r'<(\w+%s)((?:%s)*?)>([\s\S]*?)<\/\1>' % (_valid_end, _valid_attr),
+            r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (
+                _valid_end, _valid_attr),
             r'<\w+%s(?:%s)*?>' % (_valid_end, _valid_attr),
         )
     )
     autolink = re.compile(r'^<([^ >]+(@|:)[^ >]+)>')
     link = re.compile(
         r'^!?\[('
         r'(?:\[[^^\]]*\]|[^\[\]]|\](?=[^\[]*\]))*'
         r')\]\('
         r'''\s*(<)?([\s\S]*?)(?(2)>)(?:\s+['"]([\s\S]*?)['"])?\s*'''
         r'\)'
     )
     reflink = re.compile(
         r'^!?\[('
         r'(?:\[[^^\]]*\]|[^\[\]]|\](?=[^\[]*\]))*'
         r')\]\s*\[([^^\]]*)\]'
     )
     nolink = re.compile(r'^!?\[((?:\[[^\]]*\]|[^\[\]])*)\]')
     url = re.compile(r'''^(https?:\/\/[^\s<]+[^<.,:;"')\]\s])''')
     double_emphasis = re.compile(
         r'^_{2}([\s\S]+?)_{2}(?!_)'  # __word__