perf: fast-fail link tokenizing when no ')' remains ahead

[koding88]

Marked version: master (c430a64, v18.0.10)

Markdown flavor: n/a (parser performance)

Description

The inline link rule backtracks quadratically over unterminated link sequences:

marked.parse('[a](b'.repeat(20000)) // 97KB input

Input size	Before	After
48KB ([a](b×10k)	~550ms	~7ms
97KB ([a](b×20k)	~2500ms	~24ms
195KB	~9.9s	~28ms
390KB	(minutes)	~63ms

Doubling the input quadruples the time — O(n²). At every [, the rule's greedy unquoted-href run [^ \t\n\x00-\x1f]+ swallows the entire remainder and then re-partitions it char-by-char while hunting for a closing `)" that never comes; the lexer advances one character and repeats. This is the same class as #4013 (empty-href + whitespace variant), but with non-empty content between brackets, so that fix does not cover it — and none of the existing redos guards match this shape.

The change

Lexer.inlineTokens anchors one lastIndexOf(')') scan per inline run, and Tokenizer.link consults it before running the regex: since every src it receives during the run is a suffix of that anchor, "is there a `) ahead?" is answerable in O(1). When no paren remains, the regex cannot match anyway, so skipping is semantics-preserving — the skip only removes the dead backtracking.

Details:

• Anchors are saved/restored around nested inline runs (e.g. link-label lexing), so outer runs keep a valid anchor after recursion returns.
• Hints live in a module-level WeakMap keyed by the tokenizer instance, so nothing appears on the public tokenizer API surface.
• A standalone tokenizer.link() call outside a lexer run lazily anchors itself.

An earlier design that re-anchored on run-id mismatch instead of saving/restoring was 100× slower on reflink-heavy input (quadratic_inline_masking[2] blew its budget at ~10s); save/restore fixed that while keeping the unterminated-link win.

Verification

• Differential check: 1,506 generated documents (links with titles, balanced parens, angle destinations, images, autolinks, code spans containing brackets/parens, escaped chars, reflinks + defs, nested brackets, unterminated sequences) × gfm on/off → byte-identical output before/after.
• New guard test/specs/redos/quadratic_unterminated_links.cjs: exceeds the redos budget on master (~13.7s), passes with this change.
• npm test green: 1791 spec tests, 191 unit tests, UMD/CJS, types, ESLint.

AI disclosure: OpenAI Codex assisted with implementation and validation; I reviewed the parser behavior, ran the differential suite, and own the contribution.

Contributor

• Test(s) exist to ensure functionality and minimize regression.
• If submitting new feature, it has been documented in the appropriate places.

Committer

In most cases, this should be a different person than the contributor.

• CI is green (no forced merge required).
• Squash and Merge PR following conventional commit guidelines.

[vercel]

@koding88 is attempting to deploy a commit to the MarkedJS Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Pull request overview

This PR addresses a quadratic-time performance issue in inline link tokenization for unterminated inline link patterns (e.g., "[a](b".repeat(n)), by adding a fast-fail check that avoids triggering pathological regex backtracking when no closing ) exists in the remaining source.

Changes:

• Add a per-inline-run “last )” anchor hint stored/restored by Lexer.inlineTokens to enable O(1) “any ) ahead?” checks.
• Update Tokenizer.link to consult the hint and skip link-regex evaluation when no ) can possibly occur in the remaining suffix.
• Add a new ReDoS regression spec for quadratic unterminated inline links.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
test/specs/redos/quadratic_unterminated_links.cjs	Adds a regression case to ensure unterminated inline-link inputs no longer exceed the ReDoS budget.
src/Tokenizer.ts	Introduces the WeakMap-based hint and uses it in link() to fast-fail before running the expensive regex.
src/Lexer.ts	Anchors/restores the hint around each inline tokenization run so Tokenizer.link can make O(1) decisions on suffix inputs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
marked-website	Ready	Preview	Aug 25, 2026 2:14pm

[koding88]

Thank you for the review @UziTech — implemented along the lines you suggested, with one measurement worth sharing.

Your exact snippet (if (!src.includes(')')) return; at the top of link()) does fix the unterminated-link case (97KB: ~2500ms → ~62ms), but it re-scans the remainder on every link attempt. On reflink-heavy paragraphs that adds up: quadratic_inline_masking[2] ('[a]: x\n\n' + '[a] '.repeat(100000), no parens at all) went from ~140ms on master to ~1030ms — right over this suite's 1s redos budget — because link() is attempted once per token and each attempt re-scans.

So I kept your idea but hoisted the scan to one per inline run:

• Lexer.inlineTokens sets state.linkParenPossible = src.includes(')') (single scan), restoring the previous value after nested runs — the same save/restore pattern linkEmitted already uses since fix: do not nest a link inside a link #4051.
• Tokenizer.link bails only when the flag is false, which is exactly when its regex cannot match, so behavior is unchanged otherwise.

Current numbers on Node 24 (same machine):

case	master	this PR
'[a](b'.repeat(20000) (97KB)	~2500ms	~22ms
quadratic_inline_masking[2]	~140ms	~144ms

Differential: 1,506 generated docs × gfm on/off → byte-identical to master. Full npm test green including all redos guards.

Happy to flatten it further to the plain two-liner if you'd rather trade the masking[2] budget for fewer moving parts — say the word and I'll push that instead.

[UziTech]

This also only needs to be checked if prevLinkParenPossible is true, correct? Since inlineTokens will only be called with a substring of the previous call. If the previous call didn't include a ')' than neither will this one.

[koding88]

Good catch on both points — pushed 908ad32.

Line 354 (skip scan when outer had no )): you're right, a nested run receives a substring of the outer run, so if the outer had no ), neither does the substring. Changed to:

this.state.linkParenPossible = prevLinkParenPossible && src.includes(')');

so the includes(')') scan is skipped entirely for nested runs whose parent already established no ) is possible. The short-circuit also avoids touching the string at all for the common nested-reflink case.

Verified: 1791 spec + 191 unit tests pass, and the quadratic input ('[a](b'.repeat(50000)) still finishes in ~43ms (would be minutes without the guard).

[UziTech]

Thanks for helping make marked faster! 💯