2.9.0

This is a security release to address five denial-of-service vulnerabilities and one cross-site scripting (XSS) vulnerability.

Added

• Added a new NormalizeHeadingsExtension to constrain headings to a configured level range (#989)
  • Rewrites headings that skip levels so the resulting HTML is valid (#1115)
  • normalize_headings/rebase_to_min_level - rebases each document so its headings begin at min_level
• Added a new footnote/enable_inline_footnotes config option to disable the inline ^[Footnote text] syntax (#1112)
• Added Cursor::getBytePosition() for obtaining the cursor's current byte offset within the line
• Added a new xml/max_indentation_level config option to control how far XmlRenderer indents nested elements (default: 16; set to 0 for unindented output)

Changed

• The FootnoteExtension now uses only the first definition of a footnote label, removing any duplicate definitions instead of rendering them in place
• NumberFootnotesListener now stores footnote backrefs under a single footnote/backrefs key in the document data instead of one key per footnote destination
• Optimized Cursor to translate character positions to byte offsets in constant time instead of re-decoding the line with mb_substr()
• Optimized Cursor::match() to match against the line at the cursor's byte offset instead of copying the remaining line on every call
• Optimized InlineParserEngine and UrlAutolinkParser to work with byte offsets directly

Fixed

• Fixed quadratic parsing performance on lines containing multibyte characters, which could be abused to cause a denial of service (GHSA-2q4p-g7hv-5rgv)
• Fixed the unsafe link filter failing to detect dangerous schemes obfuscated with embedded tabs, newlines, or leading control characters (such as java<TAB>script:), which allowed the allow_unsafe_links protection to be bypassed via href and src attributes (GHSA-29pj-957v-52mc)
• Fixed duplicate footnote definitions each claiming the full list of backrefs for their label, causing a quadratic number of backrefs to be generated, which could be abused to cause a denial of service (GHSA-jfm3-95jq-q3rf)
• Fixed footnote labels being treated as .//-delimited key paths when storing backrefs, which allowed distinct labels such as [^a.b] and [^a/b] to share a single backref list (GHSA-jfm3-95jq-q3rf)
• Fixed a fatal error when one footnote label was a prefix of another, such as [^a] and [^a.b]
• Fixed the unique slug normalizer restarting its suffix search from 1 on every collision, causing headings or inline footnotes which normalize to the same slug to be de-duplicated in quadratic time, which could be abused to cause a denial of service (GHSA-mh25-x5hq-wrqp)
• Fixed the AttributesExtension scanning the remaining siblings of an inline attribute which can only apply to its parent block, causing long runs of adjacent inline attributes to be resolved in quadratic time, which could be abused to cause a denial of service (GHSA-g2gp-3wwq-f4ph)
• Fixed XmlRenderer indenting every element by its full nesting depth without any upper bound, causing deeply-nested documents to render as quadratically-sized XML, which could be abused to cause a denial of service (GHSA-mj63-m3rc-8ppr)
• Fixed MarkDelimiterProcessor not being declared as a CacheableDelimiterProcessorInterface, preventing the delimiter stack from caching the opener search for == runs (#1133)

New Contributors

• @AJenbo made their first contribution in #1108
• @eyupcanakman made their first contribution in #1113

Special Thanks

Special thanks to @GrahamCampbell and @TungNGo02 for responsibly disclosing the security vulnerabilities and contributing to the fixes in this release.

---

Full Changelog: 2.8.3...2.9.0