Skip to content

👌 fix possible ReDOS in newline rule #275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 2, 2023
Merged

👌 fix possible ReDOS in newline rule #275

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions markdown_it/port.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
- package: markdown-it/markdown-it
version: 12.3.1
commit: 76469e83dc1a1e3ed943b483b554003a666bddf7
date: Jan 7, 2022
version: 12.3.2
commit: d72c68b520cedacae7878caa92bf7fe32e3e0e6f
date: Jan 8, 2022
notes:
- Rename variables that use python built-in names, e.g.
- `max` -> `maximum`
Expand Down
13 changes: 7 additions & 6 deletions markdown_it/rules_inline/newline.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,7 @@
# Proceess '\n'
import re

"""Proceess '\n'."""
from ..common.utils import charStrAt, isStrSpace
from .state_inline import StateInline

endSpace = re.compile(r" +$")


def newline(state: StateInline, silent: bool) -> bool:
pos = state.pos
Expand All @@ -23,7 +19,12 @@ def newline(state: StateInline, silent: bool) -> bool:
if not silent:
if pmax >= 0 and charStrAt(state.pending, pmax) == " ":
if pmax >= 1 and charStrAt(state.pending, pmax - 1) == " ":
state.pending = endSpace.sub("", state.pending)
# Find whitespaces tail of pending chars.
ws = pmax - 1
while ws >= 1 and charStrAt(state.pending, ws - 1) == " ":
ws -= 1
state.pending = state.pending[:ws]

state.push("hardbreak", "br", 0)
else:
state.pending = state.pending[:-1]
Expand Down