Overview

https://spec.commonmark.org/0.31.2/#insecure-characters

2.3 Insecure characters
For security reasons, the Unicode character U+0000 must be replaced with the REPLACEMENT CHARACTER (U+FFFD).

§2.3 specifies that U+0000 must be replaced with U+FFFD. However pulldown-cmark doesn't conform the specification.

Repro

Check out this repository and run the following command.

echo -n "\0" | cargo run -- -e

Expected behavior

U+0000 is replaced with U+FFFD

Actual behavior

The above command outputs

0..1: Start(Paragraph)
0..1: Text(Borrowed("\0"))
0..1: End(Paragraph)
EOF

U+0000 is not replaced in the output.