Skip to content

Commit c4a3ccd

Browse files
UziTechmakenowjust
andauthoredJan 13, 2022
Merge pull request from GHSA-rrrm-qjm4-v8hf
* fix: fix reflink redos Co-authored-by: MakeNowJust <make.just.on@gmail.com> * fix: fix def redos Co-authored-by: MakeNowJust <make.just.on@gmail.com> * fix block label for multiple slashes Co-authored-by: MakeNowJust <make.just.on@gmail.com>
1 parent d7212a6 commit c4a3ccd

File tree

4 files changed

+17
-4
lines changed

4 files changed

+17
-4
lines changed
 

‎src/rules.js

+9-4
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ export const block = {
2525
+ '|<(?!script|pre|style|textarea)([a-z][\\w-]*)(?:attribute)*? */?>(?=[ \\t]*(?:\\n|$))[\\s\\S]*?(?:(?:\\n *)+\\n|$)' // (7) open tag
2626
+ '|</(?!script|pre|style|textarea)[a-z][\\w-]*\\s*>(?=[ \\t]*(?:\\n|$))[\\s\\S]*?(?:(?:\\n *)+\\n|$)' // (7) closing tag
2727
+ ')',
28-
def: /^ {0,3}\[(label)\]: *\n? *<?([^\s>]+)>?(?:(?: +\n? *| *\n *)(title))? *(?:\n+|$)/,
28+
def: /^ {0,3}\[(label)\]: *(?:\n *)?<?([^\s>]+)>?(?:(?: +(?:\n *)?| *\n *)(title))? *(?:\n+|$)/,
2929
table: noopTest,
3030
lheading: /^([^\n]+)\n {0,3}(=+|-+) *(?:\n+|$)/,
3131
// regex template, placeholders will be replaced according to different paragraph
@@ -34,7 +34,7 @@ export const block = {
3434
text: /^[^\n]+/
3535
};
3636

37-
block._label = /(?!\s*\])(?:\\[\[\]]|[^\[\]])+/;
37+
block._label = /(?!\s*\])(?:\\.|[^\[\]\\])+/;
3838
block._title = /(?:"(?:\\"?|[^"\\])*"|'[^'\n]*(?:\n[^'\n]+)*\n?'|\([^()]*\))/;
3939
block.def = edit(block.def)
4040
.replace('label', block._label)
@@ -162,8 +162,8 @@ export const inline = {
162162
+ '|^<![a-zA-Z]+\\s[\\s\\S]*?>' // declaration, e.g. <!DOCTYPE html>
163163
+ '|^<!\\[CDATA\\[[\\s\\S]*?\\]\\]>', // CDATA section
164164
link: /^!?\[(label)\]\(\s*(href)(?:\s+(title))?\s*\)/,
165-
reflink: /^!?\[(label)\]\[(?!\s*\])((?:\\[\[\]]?|[^\[\]\\])+)\]/,
166-
nolink: /^!?\[(?!\s*\])((?:\[[^\[\]]*\]|\\[\[\]]|[^\[\]])*)\](?:\[\])?/,
165+
reflink: /^!?\[(label)\]\[(ref)\]/,
166+
nolink: /^!?\[(ref)\](?:\[\])?/,
167167
reflinkSearch: 'reflink|nolink(?!\\()',
168168
emStrong: {
169169
lDelim: /^(?:\*+(?:([punct_])|[^\s*]))|^_+(?:([punct*])|([^\s_]))/,
@@ -230,6 +230,11 @@ inline.link = edit(inline.link)
230230

231231
inline.reflink = edit(inline.reflink)
232232
.replace('label', inline._label)
233+
.replace('ref', block._label)
234+
.getRegex();
235+
236+
inline.nolink = edit(inline.nolink)
237+
.replace('ref', block._label)
233238
.getRegex();
234239

235240
inline.reflinkSearch = edit(inline.reflinkSearch, 'g')

‎test/specs/redos/cubic_def.cjs

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
module.exports = {
2+
markdown: `[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`,
3+
html: `<p>[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x</p>`,
4+
};

‎test/specs/redos/reflink_redos.html

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<p>[[]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([</p>

‎test/specs/redos/reflink_redos.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[x]: x
2+
3+
[\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\]([

0 commit comments

Comments
 (0)