commonmark / commonmark/commonmark.js
Pathological inputs
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1.6k
- Forks
- 231
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 3
Description
I have just took a look how commonmark.js deals with the pathological inputs in Cmark's pathological_tests.py and in recently reported Cmark bugs.
Below is list of commands generating input which, after copying into http://try.commonmark.org/, makes JS interpreter in Firefox or Chrome unresponsive for looong time, many of them even result in browser offering user to kill the script.
In vast majority of applications user may likely only DoS-attack his own browser so security impact of these is limited. Still, it should be fixed.
"Openers and closers multiple of 3":
python -c 'print(("a**b" + ("c* " * 50000)))'
(Fixed in CMark, see https://github.com/commonmark/cmark/issues/178)
"Nested block quotes":
python -c 'print((("> " * 50000) + "a"))'
(Works in CMark)
"Backticks":
python -c 'print("".join(map(lambda x: ("e" + "`" * x), range(1,10000))))'
(Fixed in CMark, see https://github.com/commonmark/cmark/commit/8ed5c9d)
"Unclosed inline links":
python -c 'print("[a](b" * 50000)'
Fixed in cmark: see https://github.com/commonmark/cmark/issues/214
python -c 'print("[a](<b" * 50000)'
Broken in cmark: see https://github.com/commonmark/cmark/issues/218.
"Many ref. definitions"
python -c 'print("[a]: u\n" * 16 * 50000)'
(Fixed in Cmark, see https://github.com/commonmark/cmark/pull/232)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the listed generators in http://try.commonmark.org/ and compare behavior with CMark's pathological_tests.py and the linked CMark fixes. Investigate the parser paths handling emphasis, nested block quotes, backticks, links, and reference definitions; done means these inputs no longer make the JavaScript interpreter unresponsive.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, python
- Domain
- performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100