Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Lists are handled just to 3 levels #115

Closed
hron84 opened this issue Feb 27, 2012 · 2 comments
Closed

Lists are handled just to 3 levels #115

hron84 opened this issue Feb 27, 2012 · 2 comments

Comments

@hron84
Copy link

hron84 commented Feb 27, 2012

If i write a big indented lists, it is handled just upto 3 levels, more levels are flatten into the last level of lists.

@vmg
Copy link
Owner

vmg commented Feb 27, 2012

Hey, this is intended. Redcarpet caps the max nesting of all Markdown elements, because otherwise Markdown syntax can be arbitrarily nested and used to trivially exploit/DDoS the parser with stack overflows.

See the max_nesting argument, I haven't provided any way to change it from Ruby, but feel free to change manually it in your local gem.

Beware, it's risky. Do you really need to nest stuff more than 3 levels deep?

@postmodern
Copy link

I recently ran into this, when I noticed that my ChangeLog.md was being rendered incorrectly. I double checked that it wasn't a white-space issue, by testing it with Kramdown. Sure enough RedCarpet cannot handle more than two nested lists by default. While RedCarpet does provide a max_nesting setting, GitHub leaves this at it's default value.

because otherwise Markdown syntax can be arbitrarily nested and used to trivially exploit/DDoS the parser with stack overflows

Also, I am confused when you say allowing arbitrarily nested lists can result in a Distributed Denial of Service (DDoS). Care to explain how this is possible? To my knowledge, no other markdown parser has had this issue.

Do you really need to nest stuff more than 3 levels deep?

Yes I do. My ChangeLog should be rendered correctly. Given that 3 is such a low number, I would assume most people also need this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants