Limit () nesting inside urls

Allow no more than 32 levels of nesting in `[]( (((((....))))) )` for performance reasons.
markdown-it · Nov 19, 2020 · dda9c09 · dda9c09
1 parent ce8bc42
commit dda9c09
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/lib/helpers/parse_link_destination.js b/lib/helpers/parse_link_destination.js
@@ -59,6 +59,7 @@ module.exports = function parseLinkDestination(str, pos, max) {
 
     if (code === 0x28 /* ( */) {
       level++;
+      if (level > 32) { return result; }
     }
 
     if (code === 0x29 /* ) */) {