commonmark / commonmark/commonmark.js

Pathological inputs

Open
#129 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
1.6k
Forks
231
Avg merge
2d 11h
Merged PRs (30d)
3

Description

I have just took a look how commonmark.js deals with the pathological inputs in Cmark's pathological_tests.py and in recently reported Cmark bugs.

Below is list of commands generating input which, after copying into http://try.commonmark.org/, makes JS interpreter in Firefox or Chrome unresponsive for looong time, many of them even result in browser offering user to kill the script.

In vast majority of applications user may likely only DoS-attack his own browser so security impact of these is limited. Still, it should be fixed.

"Openers and closers multiple of 3":
python -c 'print(("a**b" + ("c* " * 50000)))'

(Fixed in CMark, see https://github.com/commonmark/cmark/issues/178)

"Nested block quotes":
python -c 'print((("> " * 50000) + "a"))'

(Works in CMark)

"Backticks":
python -c 'print("".join(map(lambda x: ("e" + "`" * x), range(1,10000))))'

(Fixed in CMark, see https://github.com/commonmark/cmark/commit/8ed5c9d)

"Unclosed inline links":
python -c 'print("[a](b" * 50000)'

Fixed in cmark: see https://github.com/commonmark/cmark/issues/214

python -c 'print("[a](<b" * 50000)'

Broken in cmark: see https://github.com/commonmark/cmark/issues/218.

"Many ref. definitions"
python -c 'print("[a]: u\n" * 16 * 50000)'

(Fixed in Cmark, see https://github.com/commonmark/cmark/pull/232)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the listed generators in http://try.commonmark.org/ and compare behavior with CMark's pathological_tests.py and the linked CMark fixes. Investigate the parser paths handling emphasis, nested block quotes, backticks, links, and reference definitions; done means these inputs no longer make the JavaScript interpreter unresponsive.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, python
Domain
performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.