a **b *c d c* b**
+``` + ## Additional Filtering Although this library does offer these security features out-of-the-box, some users may opt to also run the HTML output through additional filtering layers (like HTMLPurifier). If you do this, make sure you **thoroughly** test your additional post-processing steps and configure them to work properly with the types of HTML elements and attributes that converted Markdown might produce, otherwise, you may end up with weird behavior like missing images, broken links, mismatched HTML tags, etc. diff --git a/docs/2.6/upgrading.md b/docs/2.6/upgrading.md index 4e84686028..5d6e91c3c6 100644 --- a/docs/2.6/upgrading.md +++ b/docs/2.6/upgrading.md @@ -6,3 +6,27 @@ redirect_from: /upgrading/ --- # Upgrading from 2.5 to 2.6 + +## `max_delimiters_per_line` Configuration Option + +The `max_delimiters_per_line` configuration option was added in 2.6 to help protect against malicious input that could +cause excessive memory usage or denial of service attacks. It defaults to `PHP_INT_MAX` (no limit) for backwards +compatibility, which is safe when parsing trusted input. However, if you're parsing untrusted input from users, you +should probably set this to a reasonable value (somewhere between `100` and `1000`) to protect against malicious inputs. + +## Custom Delimiter Processors + +If you're implementing a custom delimiter processor, and `getDelimiterUse()` has more logic than just a +simple `return` statement, you should implement `CacheableDelimiterProcessorInterface` instead of +`DelimiterProcessorInterface` to improve performance and avoid possible quadratic performance issues. + +`DelimiterProcessorInterface` has a `getDelimiterUse()` method that tells the engine how many characters from the +matching delimiters should be consumed. Simple processors usually always return a hard-coded integer like `1` or `2`. +However, some more advanced processors may need to examine the opening and closing delimiters and perform additional +logic to determine whether they should be fully or partially consumed. Previously, these results could not be safely +cached, resulting in possible quadratic performance issues. + +In 2.6, the `CacheableDelimiterProcessorInterface` was introduced to allow these "dynamic" processors to be safely +cached. It requires a new `getCacheKey()` method that returns a string that uniquely identifies the combination of +factors considered when determining the delimiter use. This key is then used to cache the results of the search for +a matching delimiter. diff --git a/phpstan.neon.dist b/phpstan.neon.dist index e25d706246..54d7b4b6f5 100644 --- a/phpstan.neon.dist +++ b/phpstan.neon.dist @@ -7,6 +7,8 @@ parameters: message: '#Parameter .+ of class .+Reference constructor expects string, string\|null given#' - path: src/Util/RegexHelper.php message: '#Method .+RegexHelper::unescape\(\) should return string but returns string\|null#' + - path: src/Delimiter/DelimiterStack.php + message: '#unknown class WeakMap#' exceptions: uncheckedExceptionClasses: # Exceptions caused by bad developer logic that should always bubble up: diff --git a/src/Delimiter/Bracket.php b/src/Delimiter/Bracket.php new file mode 100644 index 0000000000..3a86859c71 --- /dev/null +++ b/src/Delimiter/Bracket.php @@ -0,0 +1,83 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace League\CommonMark\Delimiter; + +use League\CommonMark\Node\Node; + +final class Bracket +{ + private Node $node; + private ?Bracket $previous; + private bool $hasNext = false; + private int $position; + private bool $image; + private bool $active = true; + + public function __construct(Node $node, ?Bracket $previous, int $position, bool $image) + { + $this->node = $node; + $this->previous = $previous; + $this->position = $position; + $this->image = $image; + } + + public function getNode(): Node + { + return $this->node; + } + + public function getPrevious(): ?Bracket + { + return $this->previous; + } + + public function hasNext(): bool + { + return $this->hasNext; + } + + public function getPosition(): int + { + return $this->position; + } + + public function isImage(): bool + { + return $this->image; + } + + /** + * Only valid in the context of non-images (links) + */ + public function isActive(): bool + { + return $this->active; + } + + /** + * @internal + */ + public function setHasNext(bool $hasNext): void + { + $this->hasNext = $hasNext; + } + + /** + * @internal + */ + public function setActive(bool $active): void + { + $this->active = $active; + } +} diff --git a/src/Delimiter/DelimiterInterface.php b/src/Delimiter/DelimiterInterface.php index 6bfa32e48e..0cefba7e60 100644 --- a/src/Delimiter/DelimiterInterface.php +++ b/src/Delimiter/DelimiterInterface.php @@ -24,8 +24,14 @@ public function canClose(): bool; public function canOpen(): bool; + /** + * @deprecated This method is no longer used internally and will be removed in 3.0 + */ public function isActive(): bool; + /** + * @deprecated This method is no longer used internally and will be removed in 3.0 + */ public function setActive(bool $active): void; public function getChar(): string; diff --git a/src/Delimiter/DelimiterParser.php b/src/Delimiter/DelimiterParser.php index 3f96addf85..fdfe093c90 100644 --- a/src/Delimiter/DelimiterParser.php +++ b/src/Delimiter/DelimiterParser.php @@ -62,16 +62,20 @@ public function parse(InlineParserContext $inlineContext): bool [$canOpen, $canClose] = self::determineCanOpenOrClose($charBefore, $charAfter, $character, $processor); + if (! ($canOpen || $canClose)) { + $inlineContext->getContainer()->appendChild(new Text(\str_repeat($character, $numDelims))); + + return true; + } + $node = new Text(\str_repeat($character, $numDelims), [ 'delim' => true, ]); $inlineContext->getContainer()->appendChild($node); // Add entry to stack to this opener - if ($canOpen || $canClose) { - $delimiter = new Delimiter($character, $numDelims, $node, $canOpen, $canClose); - $inlineContext->getDelimiterStack()->push($delimiter); - } + $delimiter = new Delimiter($character, $numDelims, $node, $canOpen, $canClose, $inlineContext->getCursor()->getPosition()); + $inlineContext->getDelimiterStack()->push($delimiter); return true; } diff --git a/src/Delimiter/DelimiterStack.php b/src/Delimiter/DelimiterStack.php index fb95b907cf..cf2a41e524 100644 --- a/src/Delimiter/DelimiterStack.php +++ b/src/Delimiter/DelimiterStack.php @@ -19,16 +19,47 @@ namespace League\CommonMark\Delimiter; +use League\CommonMark\Delimiter\Processor\CacheableDelimiterProcessorInterface; use League\CommonMark\Delimiter\Processor\DelimiterProcessorCollection; use League\CommonMark\Node\Inline\AdjacentTextMerger; +use League\CommonMark\Node\Node; final class DelimiterStack { /** @psalm-readonly-allow-private-mutation */ private ?DelimiterInterface $top = null; + /** @psalm-readonly-allow-private-mutation */ + private ?Bracket $brackets = null; + + /** + * @deprecated This property will be removed in 3.0 once all delimiters MUST have an index/position + * + * @var \SplObjectStoragea b c b
']; + + yield ['*a* **b *c **d** c* b**', 0, '*a* **b *c **d** c* b**
']; + yield ['*a* **b *c **d** c* b**', 1, '*a* **b *c **d** c* b**
']; + yield ['*a* **b *c **d** c* b**', 2, 'a **b *c **d** c* b**
']; + yield ['*a* **b *c **d** c* b**', 3, 'a **b *c **d** c* b**
']; + yield ['*a* **b *c **d** c* b**', 4, 'a **b *c **d** c* b**
']; + yield ['*a* **b *c **d** c* b**', 5, 'a **b *c **d** c* b**
']; + yield ['*a* **b *c **d** c* b**', 6, 'a **b *c d c* b**
']; + yield ['*a* **b *c **d** c* b**', 7, 'a **b c d c b**
']; + yield ['*a* **b *c **d** c* b**', 8, 'a b c d c b
']; + yield ['*a* **b *c **d** c* b**', 9, 'a b c d c b
']; + yield ['*a* **b *c **d** c* b**', 100, 'a b c d c b
']; + } +} diff --git a/tests/pathological/convert.php b/tests/pathological/convert.php new file mode 100755 index 0000000000..51c6d42330 --- /dev/null +++ b/tests/pathological/convert.php @@ -0,0 +1,62 @@ +#!/usr/bin/env php + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +ini_set('memory_limit', '1024M'); + +use League\CommonMark\Environment\Environment; +use League\CommonMark\Extension\CommonMark\CommonMarkCoreExtension; +use League\CommonMark\Extension\Footnote\FootnoteExtension; +use League\CommonMark\Extension\GithubFlavoredMarkdownExtension; +use League\CommonMark\Extension\Table\TableExtension; +use League\CommonMark\MarkdownConverter; + +require_once __DIR__ . '/../../vendor/autoload.php'; + +ini_set('display_errors', 'stderr'); +ini_set('xdebug.max_nesting_level', '999999'); + +$stdin = fopen('php://stdin', 'r'); +if (stream_set_blocking($stdin, true)) { + $markdown = stream_get_contents($stdin); +} +fclose($stdin); + +if (empty($markdown)) { + fwrite(STDERR, "No input provided\n"); + exit(1); +} + +$config = []; +if (isset($argv[1])) { + $config = \json_decode($argv[1], true); +} + +$environment = new Environment($config); +$environment->addExtension(new CommonMarkCoreExtension()); + +// Enable additional extensions if requested +switch ($argv[2] ?? null) { + case 'table': + $environment->addExtension(new TableExtension()); + break; + case 'footnotes': + $environment->addExtension(new FootnoteExtension()); + break; + case 'gfm': + default: + $environment->addExtension(new GithubFlavoredMarkdownExtension()); + break; +} + +$converter = new MarkdownConverter($environment); + +echo $converter->convert($markdown)->getContent(); diff --git a/tests/pathological/test.php b/tests/pathological/test.php new file mode 100755 index 0000000000..fea326a449 --- /dev/null +++ b/tests/pathological/test.php @@ -0,0 +1,386 @@ +#!/usr/bin/env php + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +use Symfony\Component\Process\Exception\ProcessSignaledException; +use Symfony\Component\Process\Exception\ProcessTimedOutException; +use Symfony\Component\Process\Process; + +require_once __DIR__ . '/../../vendor/autoload.php'; + +$cases = [ + 'U+0000 in input' => [ + 'sizes' => [1], + 'input' => static fn($n) => "abc\u{0000}def\u{0000}\n", + 'expected' => static fn($n) => "abc\u{FFFD}def\u{FFFD}
", + ], + 'Alternate line endings' => [ + 'sizes' => [1], + 'input' => static fn($n) => "- a\n- b\r- c\r\n- d", + 'expected' => static fn($n) => "' . \str_repeat('a a ', $n) . 'b' . \str_repeat(' a a', $n) . '
', + ], + 'Emphasis closers with no openers' => [ + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('a_ ', $n), + 'expected' => static fn($n) => '' . \str_repeat('a_ ', $n - 1) . 'a_
', + ], + 'Emphasis openers with no closers' => [ + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('_a ', $n), + 'expected' => static fn($n) => '' . \str_repeat('_a ', $n - 1) . '_a
', + ], + 'Openers and closers multiple of 3' => [ + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => 'a**b' . \str_repeat('c* ', $n), + 'expected' => static fn($n) => 'a**b' . \str_repeat('c* ', $n - 1) . 'c*
', + ], + 'Delimiters that cannot open or close' => [ + 'ref' => 'https://github.com/commonmark/commonmark.js/issues/172', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('*_* _ ', $n), + 'expected' => static fn($n) => '' . \str_repeat('_ _ ', $n - 1) . '_ _
', + ], + 'Link closers with no openers' => [ + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('a] ', $n), + 'expected' => static fn($n) => '' . \str_repeat('a] ', $n - 1) . 'a]
', + ], + 'Link openers with no closers' => [ + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('[a ', $n), + 'expected' => static fn($n) => '' . \str_repeat('[a ', $n - 1) . '[a
', + ], + 'Link openers and emphasis closers' => [ + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('[ a_ ', $n), + 'expected' => static fn($n) => '' . \str_repeat('[ a_ ', $n - 1) . '[ a_
', + ], + 'Mismatched openers and closers' => [ + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('*a_ ', $n), + 'expected' => static fn($n) => '' . \str_repeat('*a_ ', $n - 1) . '*a_
', + ], + 'Pattern [ (](' => [ + 'sizes' => [500, 5_000, 50_000], + 'input' => static fn($n) => \str_repeat('[ (](', $n), + 'expected' => static fn($n) => '' . \str_repeat('[ (](', $n) . '
', + ], + 'Nested brackets' => [ + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('[', $n) . 'a' . \str_repeat(']', $n), + 'expected' => static fn($n) => '' . \str_repeat('[', $n) . 'a' . \str_repeat(']', $n) . '
', + ], + 'Backslash in link' => [ + 'ref' => 'https://github.com/commonmark/commonmark.js/issues/157', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => '[' . \str_repeat('\\', $n) . "\n", + 'expected' => static fn($n) => '[' . \str_repeat('\\', $n / 2) . '
', + ], + 'Backslash in unclosed link title' => [ + 'sizes' => [10, 100, 1_000], + 'input' => static fn($n) => '[test](\\url "' . \str_repeat('\\', $n) . "\n", + 'expected' => static fn($n) => '[test](\\url "' . \str_repeat('\\', $n / 2) . '
', + ], + 'Unclosed inline links (1)' => [ + 'ref' => 'https://github.com/commonmark/commonmark.js/issues/129', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('[](', $n), + 'expected' => static fn($n) => '' . \str_repeat('[](', $n) . '
', + ], + 'Unclosed inline links (2)' => [ + 'ref' => 'https://github.com/commonmark/commonmark.js/issues/129', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('[a](b', $n), + 'expected' => static fn($n) => '' . \str_repeat('[a](b', $n) . '
', + ], + 'Unclosed inline links (3)' => [ + 'ref' => 'https://github.com/commonmark/commonmark.js/issues/129', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('[a](' . \str_repeat('[a](<b', $n) . '
', + ], + 'Nested blockquotes' => [ + 'ref' => 'https://github.com/commonmark/commonmark.js/issues/129', + 'sizes' => [100, 1_000], + 'input' => static fn($n) => \str_repeat('> ', $n) . "a\n", + 'expected' => static fn($n) => \str_repeat("\n", $n) . "\n", $n), + ], + 'Backticks' => [ + 'ref' => 'https://github.com/commonmark/commonmark.js/issues/129', + 'sizes' => [500, 1_000, 2_000, 4_000], + 'input' => static fn($n) => \implode('', \array_map(static fn($i) => 'e' . \str_repeat('`', $i), \range(1, $n))), + ], + 'Many ref. definitions' => [ + 'ref' => 'https://github.com/commonmark/commonmark.js/issues/129', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat("[a]: u\n", $n), + ], + 'Huge horizontal rule' => [ + 'sizes' => [500, 5_000], + 'input' => static fn($n) => \str_repeat('*', $n) . "\n", + 'expected' => static fn($n) => 'a
\n" . \str_repeat("
' . \str_repeat('![l', $n) . '
', + ], + 'CVE-2023-22486' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('![[]()', $n) . "\n", + 'expected' => static fn($n) => '', + ], + 'CVE-2023-22484' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => ' static fn($n) => '</' . \str_repeat('<!--', $n) . '
', + ], + 'CVE-2023-22483 test 1' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => "-1" . \str_repeat(" static fn($n) => '-1' . \str_repeat('<?x', $n) . 'y
', + ], + 'CVE-2023-22483 test 2 (tables)' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'extension' => 'table', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat("|-\nt>|-\n", $n) . "y\n", + 'expected' => static fn($n) => '' . \str_repeat("|-\nt>|-\n", $n) . 'y
', + ], + 'CVE-2023-22483 test 3' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'sizes' => [1_000, 10_000, 20_000, 40_000], + 'input' => static fn($n) => \str_repeat('*t ', $n) . \str_repeat('_t*_ ', $n) . "\n", + 'expected' => static fn($n) => '' . \str_repeat('t ', $n) . \str_repeat('_t_ ', $n - 1) . '_t_
', + ], + 'CVE-2023-22483 test 4 (tables)' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'extension' => 'table', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => "x\n| - |\n" . \str_repeat("|", $n) . "y\n", + 'expected' => static fn($n) => "x\n| - |\n" . \str_repeat('|', $n) . 'y
', + ], + 'CVE-2023-22483 test 5 (autolink)' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat('z_www.', $n) . "\n", + ], + 'CVE-2023-22483 test 6' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'sizes' => [100, 1_000, 10_000, 100_000], + 'input' => static fn($n) => "[f]:u\n\"\n" . \str_repeat("[f]\n", $n) . "[f]:u \"t\n", + ], + 'CVE-2023-22483 test 7 (autolink)' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => "www." . \str_repeat(")", $n) . "\n", + 'expected' => static fn($n) => 'www.' . \str_repeat(')', $n) . '
', + ], + 'CVE-2023-22483 test 8 (tables)' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'extension' => 'table', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => ":-\n" . \str_repeat(":\n", $n) . ":-\n", + 'expected' => static fn($n) => ":-\n" . \str_repeat(":\n", $n) . ':-
', + ], + 'CVE-2023-22483 test 9 (autolink)' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat("' . \str_repeat('<http://s', $n) . '
', + ], + 'CVE-2023-22483 test 10 (strikethrough)' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => '~e' . \str_repeat(',z~~', $n) . "\n", + 'expected' => static fn($n) => '~e' . \str_repeat(',z~~', $n) . '
', + ], + 'CVE-2023-22483 test 11 (deeply-nested blockquotes)' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c', + 'sizes' => [100, 1_000, 2_000, 3_000], + 'input' => static fn($n) => \str_repeat(">", $n) . \str_repeat(".", $n) . "\n", + 'expected' => static fn($n) => \str_repeat("\n", $n) . '\n", $n), + ], + 'CVE-2023-24824 test 1' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => \str_repeat(">", $n) . \str_repeat("a*", $n) . "\n", + 'configuration' => [ + 'max_nesting_level' => 1_000, + ], + ], + 'CVE-2023-24824 test 2' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh', + 'sizes' => [500, 5_000, 50_000], + 'input' => static fn($n) => \str_repeat(" -", $n) . 'x' . \str_repeat("\n", $n), + 'configuration' => [ + 'max_nesting_level' => 500, + ], + ], + 'CVE-2023-26485 test 1' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5', + 'sizes' => [50, 500, 5_000], // ideally should be 1000, 10_000, 100_000 but recursive rendering makes large sizes fail + 'input' => static fn($n) => \str_repeat('_', $n) . '.' . \str_repeat('_', $n) . "\n", + 'expected' => static fn($n) => '' . \str_repeat('.', $n) . "
\n" . \str_repeat("
' . \str_repeat('', $n/2) . '.' . \str_repeat('', $n/2) . '
', + ], + 'CVE-2023-26485 test 2' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => "1.\n" . \str_repeat(" 2.\n", $n), + 'expected' => static fn($n) => "x
", + ], + 'CVE-2023-37463 test 1' => [ + 'ref' => 'https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5', + 'extension' => 'table', + 'sizes' => [1_000, 10_000, 100_000], + 'input' => static fn($n) => '|' . \str_repeat('x|', $n) . "\n|" . \str_repeat('-|', $n) . "\n", + 'expected' => static fn($n) => "| x | \n", $n) . "
|---|