Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Groups of consecutive underscores in a specific pattern hang/take a long time to convert #1927

Closed
Xegyn opened this issue Feb 5, 2021 · 12 comments · Fixed by #1864
Closed

Groups of consecutive underscores in a specific pattern hang/take a long time to convert #1927

Xegyn opened this issue Feb 5, 2021 · 12 comments · Fixed by #1864
Labels
L0 - security A security vulnerability within the Marked library is discovered

Comments

@Xegyn
Copy link

Xegyn commented Feb 5, 2021

Marked version: 1.2.9

Describe the bug
3 or more groups of odd and even-numbered consecutive underscores followed by a character takes a very long time to convert.
Example input: _______________________________ ____________________ __________________________ a
If you click on the Marked Demo link below, you will see that this takes a long time to convert (approximately 2 minutes).
The input above is:
31 underscores, 20 underscores, 26 underscores, and an a.

Modifying the input in a number of ways changes the conversion time to < 10ms:

  • modifying the above input so that the 1st group of underscores is an even number
  • modifying the 2nd or 3rd group of underscores to be an odd number
  • removing the trailing a character.

It seems that the longer the consecutive underscores are in length, the time increasingly gets longer.

To Reproduce
Steps to reproduce the behavior:

  1. Marked Demo
  2. CommonMark Demo

Expected behavior
The markdown to html conversion should take roughly the same amount of time as it does as when the above example input is modified such in one of the ways describe above (i.e. < 10ms).
@UziTech
Copy link
Member

UziTech commented Feb 5, 2021 •
edited

Looks like this was introduced in v1.1.2 somehow actually it was v1.2.0 but our releases around that point were messed up so v1.1.2 is after v1.2.0

v1.1.1 demo
v1.1.2 demo

@UziTech UziTech added the L0 - security A security vulnerability within the Marked library is discovered label Feb 5, 2021
@UziTech
Copy link
Member

UziTech commented Feb 5, 2021

After some testing it looks like #1864 fixes it. @calculuschild maybe we should release v2 with that fix sooner rather than wait for #1872 and others?

@UziTech UziTech linked a pull request Feb 5, 2021 that will close this issue
fix: Total rework of Emphasis/Strong #1864
Merged
5 tasks
@calculuschild
Copy link
Contributor

I'm not opposed to that. I'm kind of at a dead end with #1872 for now anyway.

@UziTech UziTech mentioned this issue Feb 5, 2021
Merged
5 tasks
@UziTech
Copy link
Member

UziTech commented Feb 7, 2021

This should be fixed in v2.0.0

@Xegyn
Copy link
Author

Xegyn commented Feb 8, 2021

Thank you so much for the speedy response!! 🙇‍♂️

This was referenced Feb 8, 2021
Merged
Merged
Open
Closed
Closed
Closed
Merged
Merged
Merged
@stylemistake stylemistake mentioned this issue Feb 8, 2021
Merged
This was referenced Feb 8, 2021
Merged
Closed
Closed
Closed
Merged
Merged
Merged
Open
Merged
Open
Merged
This was referenced Apr 26, 2021
Open
Closed
Open
Merged
Open
Closed
Closed
Open
Merged
Merged
This was referenced May 3, 2021
Closed
Closed
Closed
Open
Merged
Closed
Open
Closed
@julienw
Copy link

julienw commented May 11, 2021

Hey !
Do you think it would be possible to have a fix for the v1 branch as well? Some packages like docsify do not seem quick to upgrade :/ Thanks a lot for your work!

@UziTech
Copy link
Member

UziTech commented May 11, 2021

The fix has breaking changes. If this was backported to v1 those packages that don't update could break. I think it would be better for them to update their dependency then to totally break.

This was referenced May 15, 2021
Merged
Open
Open
Merged
@renovate renovate bot mentioned this issue May 25, 2021
Merged
1 task
@UziTech UziTech mentioned this issue May 31, 2021
Closed
@renovate renovate bot mentioned this issue Jun 7, 2021
Closed
1 task
@renovate renovate bot mentioned this issue Jul 22, 2021
Open
1 task
@UziTech UziTech mentioned this issue Nov 1, 2021
Closed
kodiakhq bot pushed a commit to carbon-design-system/carbon-for-ibm-dotcom that referenced this issue Jan 11, 2022
@renovate
fix(deps): update dependency marked to v2 [security] (#7980)
fa7a33c 
[![WhiteSource Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [marked](https://marked.js.org) ([source](https://togithub.com/markedjs/marked)) | [`^1.2.9` -> `^2.0.0`](https://renovatebot.com/diffs/npm/marked/1.2.9/2.0.0) | [![age](https://badges.renovateapi.com/packages/npm/marked/2.0.0/age-slim)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://badges.renovateapi.com/packages/npm/marked/2.0.0/adoption-slim)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://badges.renovateapi.com/packages/npm/marked/2.0.0/compatibility-slim/1.2.9)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://badges.renovateapi.com/packages/npm/marked/2.0.0/confidence-slim/1.2.9)](https://docs.renovatebot.com/merge-confidence/) |

### GitHub Vulnerability Alerts

#### [CVE-2021-21306](https://togithub.com/markedjs/marked/security/advisories/GHSA-4r62-v4vq-hr96)

### Impact
_What kind of vulnerability is it? Who is impacted?_

[Regular expression Denial of Service](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)

A Denial of Service attack can affect anyone who runs user generated code through `marked`.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

patched in v2.0.0

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

None.

### References
_Are there any links users can visit to find out more?_

[markedjs/marked#1927
https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [marked](https://togithub.com/markedjs/marked/issues)

---

### Release Notes

<details>
<summary>markedjs/marked</summary>

### [`v2.0.0`](https://togithub.com/markedjs/marked/releases/v2.0.0)

[Compare Source](https://togithub.com/markedjs/marked/compare/v1.2.9...v2.0.0)

##### Bug Fixes

-   Join adjacent inlineText tokens ([#&#8203;1926](https://togithub.com/markedjs/marked/issues/1926)) ([f848e77](https://togithub.com/markedjs/marked/commit/f848e7703956a6c37871432a7e128f51b1700aa0))
-   Total rework of Emphasis/Strong ([#&#8203;1864](https://togithub.com/markedjs/marked/issues/1864)) ([7293251](https://togithub.com/markedjs/marked/commit/7293251c438e3ee968970f7609f1a27f9007bccd))

##### BREAKING CHANGES

-   `em` and `strong` tokenizers have been merged into one `emStrong` tokenizer.
-   `code` and `text` tokenizers do not get passed all tokens as a second parameter.
-   No longer supporting IE 11. IE 11 may still work but we are not committed to making sure it works with every update. We still provide an es5 version in `lib/marked.js` but some pollyfills may be needed for IE 11 in the future.

</details>

---

### Configuration

📅 **Schedule**: "" (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by [WhiteSource Renovate](https://renovate.whitesourcesoftware.com). View repository job log [here](https://app.renovatebot.com/dashboard#github/carbon-design-system/carbon-for-ibm-dotcom).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
L0 - security A security vulnerability within the Marked library is discovered
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: Total rework of Emphasis/Strong calculuschild/marked
5 participants
@UziTech @XhmikosR @julienw @Xegyn @calculuschild