markdown2 malformed HTML tokenizer CPU denial of service

Describe the bug
python-markdown2 can spend unbounded CPU in its inline HTML tokenizer when rendering attacker-controlled Markdown containing repeated malformed tag fragments. At the pinned commit, the public markdown2.markdown() path can pass that text to _sorta_html_tokenize_re.split() in lib/markdown2.py, and a roughly 60 KB input deterministically reaches the local one-second timeout oracle. Applications that render untrusted Markdown synchronously can therefore have request workers tied up by a single document.

To Reproduce
INT-regex-markdown2-html-tokenizer-redos.zip

See attached file.

bash ./poc/run.sh

timed_out after 1s

Expected behavior
Tag-branch regex fails to match the malformed fragment in linear time.

Debug info

• Project: markdown2
• Repo: https://github.com/trentm/python-markdown2
• Pinned ref: 28d94df671eb2a149643310513f84bb00a084072

For more details, see README.md of attached file.

Start in lib/markdown2.py at _sorta_html_tokenize_re.split() and reproduce the issue with bash ./poc/run.sh using the attached proof of concept. Inspect the tag-branch regex and verify that malformed fragments no longer trigger the one-second timeout while preserving expected HTML tokenization behavior.