From 856340fc871e1f01e75df9ea83c573d50cacafed Mon Sep 17 00:00:00 2001 From: Tony Brix Date: Thu, 25 May 2023 18:43:11 -0500 Subject: [PATCH 1/2] fix: fix redos in em mask --- src/rules.js | 2 +- test/helpers/load.js | 5 +++-- test/specs/redos/quadratic_em_mask.cjs | 18 ++++++++++++++++++ 3 files changed, 22 insertions(+), 3 deletions(-) create mode 100644 test/specs/redos/quadratic_em_mask.cjs diff --git a/src/rules.js b/src/rules.js index 322825bbcb..bfd04f7419 100644 --- a/src/rules.js +++ b/src/rules.js @@ -187,7 +187,7 @@ inline._punctuation = '!"#$%&\'()+\\-.,/:;<=>?@\\[\\]`^{|}~'; inline.punctuation = edit(inline.punctuation).replace(/punctuation/g, inline._punctuation).getRegex(); // sequences em should skip over [title](link), `code`, -inline.blockSkip = /\[[^\]]*?\]\([^\)]*?\)|`[^`]*?`|<[^>]*?>/g; +inline.blockSkip = /\[[^[\]]*?\]\([^\)]*?\)|`[^`]*?`|<[^<>]*?>/g; // lookbehind is not available on Safari as of version 16 // inline.escapedEmSt = /(?<=(?:^|[^\\)(?:\\[^])*)\\[*_]/g; inline.escapedEmSt = /(?:^|[^\\])(?:\\\\)*\\[*_]/g; diff --git a/test/helpers/load.js b/test/helpers/load.js index 77cd6a8f1f..4aa650944b 100644 --- a/test/helpers/load.js +++ b/test/helpers/load.js @@ -111,9 +111,10 @@ export function loadFiles(dir) { return obj; } - for (const spec of specs) { + for (let i = 0; i < specs.length; i++) { + const spec = specs[i]; if (!spec.section) { - spec.section = name; + spec.section = `${name}[${i}]`; } if (!obj[spec.section]) { obj[spec.section] = { diff --git a/test/specs/redos/quadratic_em_mask.cjs b/test/specs/redos/quadratic_em_mask.cjs new file mode 100644 index 0000000000..e71155e1a4 --- /dev/null +++ b/test/specs/redos/quadratic_em_mask.cjs @@ -0,0 +1,18 @@ +module.exports = [ + { + markdown: '['.repeat(100000), + html: `

${'['.repeat(100000)}

` + }, + { + markdown: '[.'.repeat(50000), + html: `

${'[.'.repeat(50000)}

` + }, + { + markdown: '<'.repeat(100000), + html: `

${'<'.repeat(100000)}

` + }, + { + markdown: '<.'.repeat(50000), + html: `

${'<.'.repeat(50000)}

` + } +]; From 48f64d4a40c1fa2ee5c0f79bc57851d958c35901 Mon Sep 17 00:00:00 2001 From: Tony Brix Date: Thu, 25 May 2023 19:22:33 -0500 Subject: [PATCH 2/2] also remove ( --- src/rules.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rules.js b/src/rules.js index bfd04f7419..02610c7d26 100644 --- a/src/rules.js +++ b/src/rules.js @@ -187,7 +187,7 @@ inline._punctuation = '!"#$%&\'()+\\-.,/:;<=>?@\\[\\]`^{|}~'; inline.punctuation = edit(inline.punctuation).replace(/punctuation/g, inline._punctuation).getRegex(); // sequences em should skip over [title](link), `code`, -inline.blockSkip = /\[[^[\]]*?\]\([^\)]*?\)|`[^`]*?`|<[^<>]*?>/g; +inline.blockSkip = /\[[^[\]]*?\]\([^\(\)]*?\)|`[^`]*?`|<[^<>]*?>/g; // lookbehind is not available on Safari as of version 16 // inline.escapedEmSt = /(?<=(?:^|[^\\)(?:\\[^])*)\\[*_]/g; inline.escapedEmSt = /(?:^|[^\\])(?:\\\\)*\\[*_]/g;