Merge pull request #1224 from davisjam/SonatypeReport

security: fix unsafe heading regex
markedjs · Apr 16, 2018 · 09afabf · 09afabf
2 parents 2531a2e + f052a2c
commit 09afabf
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/marked.js b/lib/marked.js
@@ -16,7 +16,7 @@ var block = {
   code: /^( {4}[^\n]+\n*)+/,
   fences: noop,
   hr: /^ {0,3}((?:- *){3,}|(?:_ *){3,}|(?:\* *){3,})(?:\n+|$)/,
-  heading: /^ *(#{1,6}) *([^\n]+?) *#* *(?:\n+|$)/,
+  heading: /^ *(#{1,6}) *([^\n]+?) *(?:#+ *)?(?:\n+|$)/,
   nptable: noop,
   blockquote: /^( {0,3}> ?(paragraph|[^\n]*)(?:\n|$))+/,
   list: /^( *)(bull) [\s\S]+?(?:hr|def|\n{2,}(?! )(?!\1bull )\n*|\s*$)/,