fix image links with escaped brackets #1683
Conversation
|
This pull request is being automatically deployed with Vercel (learn more). 🔍 Inspect: https://vercel.com/markedjs/markedjs/qpzfg7jxn |
src/rules.js
Outdated
| inline._label = /(?:\[[^\[\]]*\]|\\.|`[^`]*`|[^\[\]\\`])*?/; | ||
| inline._label = /(?:\[(?:\\.|[^\[\]])*\]|\\.|`[^`]*`|[^\[\]\\`])*?/; |
There was a problem hiding this comment.
@davisjam is this regex safe from ReDOS?
There was a problem hiding this comment.
Sadly, it has moved from linear to exponential.
Visualization -- The problem is in the top group. The OR can be satisfied on the top or the bottom using \\a, and if the subsequent ] is missing then you get exponential backtracking.
Example misbehavior:
/\[(?:\\.|[^\[\]])*\]/.exec("[" + "\\a".repeat(300));
There was a problem hiding this comment.
what about removing \\ from the second path (/\[(?:\\.|[^\\\[\]])*\]/)? that way the only path it can take is determined by whether it sees a \\
There was a problem hiding this comment.
@davisjam thanks for your help on this. Your regex experience is invaluable.
Marked version: 1.1.0
Description
Fix image link with
\[or\]in alt textdemo
Contributor
Committer
In most cases, this should be a different person than the contributor.