fix: Avoid O(n^2) backtracking in GFM email autolink regexes - #5
Closed
hong4rc wants to merge 10 commits into
Closed
fix: Avoid O(n^2) backtracking in GFM email autolink regexes#5hong4rc wants to merge 10 commits into
hong4rc wants to merge 10 commits into
Conversation
…rkedjs#4021) Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
…s#4020) Signed-off-by: dependabot[bot] <support@github.com>
…js#4015) A line like `#1 Goals` or `#hashtag` followed by a setext underline was rendered as a paragraph plus `<hr>` instead of a heading. A line only starts an ATX heading when the `#`s are followed by whitespace or EOL, so these are paragraph text and the underline makes a setext heading. The lheading ATX-interrupt check was bare ` {0,3}#{1,6}`, missing the `(?:\s|$)` that the paragraph and ATX heading rules already require.
* fix: preserve code spans adjacent to tildes * perf: isolate mixed delimiter boundaries * refactor: keep delimiter boundaries in grammar
A blockquote followed by a bare list marker line (for example
`> foo\n-`) wrongly nested an empty list inside the blockquote.
The blockquote regex reuses the paragraph list-interrupt clause
` {0,3}(?:[*+-]|1[.)])[ \t]+[^ \t\n]`, whose trailing `[ \t]+[^ \t\n]`
requires content after the marker. A bare marker line therefore was
not seen as an interruption and got lazily continued into the
blockquote paragraph, then re-lexed into a nested empty list.
Give the blockquote its own paragraph variant whose list-interrupt
clause also matches a bare marker, so the list ends the blockquote and
becomes a sibling block. The top level paragraph rule is unchanged, so
an empty list still cannot interrupt a paragraph.
…t regexes (markedjs#4014) * fix: Avoid O(n^2) backtracking in HTML block close regex The close branches end in `[^\n]*\n+`; the trailing `\n+` requires a newline, so at EOF the close can't match and the engine retries every split of the lazy `[\s\S]*?` before falling through to `$`, which is O(n^2). `\n*` closes on first match and consumes identical text whenever a trailing newline is present (the `[^\n]*` was added in markedjs#3991). * fix: Avoid O(n^2) backtracking in tilde paragraph interrupt regex The backtick branch is guarded by a lookahead but `~{3,}` isn't, and it overlaps the following `[^\n]*`, so a long newline-less tilde run backtracks quadratically. Since `~{3,}` is always followed by `[^\n]*`, `~~~` matches the same strings without the overlap. The real fences tokenizer is left untouched.
hong4rc
force-pushed
the
perf/linear-email-autolink
branch
from
July 19, 2026 02:53
d0a7fa6 to
c19413b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same shape of bug as markedjs#4013, this time in the GFM email autolink path.
The
urlrule (used for autolinking bare emails) and thetextrule (used to find where the next inline token starts) each retry at every character position in the input, and each one contains an unbounded[A-Za-z0-9._+-]+run that scans forward looking for an@. When the input has a long run of local-part-looking characters with no@anywhere in it, every one of those retries rescans the same tail of the string, so tokenizing goes quadratic in the length of that run.The fix bounds both runs to
{1,64}instead of+, matching RFC 5321's 64-character limit on the email local part. That caps how far each scan can walk, so tokenizing stays linear, and it doesn't lose any valid input — a local part longer than 64 characters was never a valid email to begin with.Checked with the full spec suite (1753/1753, no output changes) plus a new
test/specs/redos/quadratic_email_autolink.cjscase that's red before the fix and green after. Timing-wise,parse('a_'.repeat(32000))went from ~2420ms to ~33ms.While in there I noticed the sibling
<email>-bracket autolink rule around rules.ts:379 has the same unbounded-run shape — didn't touch it here since it's a separate code path, but it's a plausible follow-up.