Limit () nesting inside urls

Allow no more than 32 levels of nesting in `[]( (((((....))))) )` for performance reasons. close #732
markdown-it · Nov 19, 2020 · 1910a3c · 1910a3c
1 parent f688abc
commit 1910a3c
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [12.0.3] - WIP
 ### Fixed
 - `[](<foo<bar>)` is no longer a valid link.
+- Fix performance issues when parsing links, #732.
 
 
 ## [12.0.2] - 2020-10-23

diff --git a/lib/helpers/parse_link_destination.js b/lib/helpers/parse_link_destination.js
@@ -59,6 +59,7 @@ module.exports = function parseLinkDestination(str, pos, max) {
 
     if (code === 0x28 /* ( */) {
       level++;
+      if (level > 32) { return result; }
     }
 
     if (code === 0x29 /* ) */) {