Skip to content

Reject link reference definitions with unbalanced parentheses in the destination - #470

Open
wleeaf wants to merge 1 commit into
commonmark:mainfrom
wleeaf:fix-link-destination-unbalanced-parens
Open

wleeaf wants to merge 1 commit into
commonmark:mainfrom
wleeaf:fix-link-destination-unbalanced-parens

Conversation

@wleeaf

@wleeaf wleeaf commented Oct 24, 2026

Copy link
Copy Markdown

A link destination may contain parentheses only if they are escaped or part of a balanced pair. LinkScanner.scanLinkDestinationWithBalancedParens checks the balance when it sees ), but returns success at a space, a control character (including the line ending) or the end of the input without checking that all opened parentheses were closed. For inline links the following ) check catches this. For link reference definitions it does not, so invalid definitions are accepted and their text disappears:

Markdown cmark / commonmark.js commonmark-java
[foo]: ( <p>[foo]: (</p> (nothing)
[foo]: (\nbar <p>[foo]: (\nbar</p> <p>bar</p>
[foo]: a(b\n\n[foo] <p>[foo]: a(b</p>\n<p>[foo]</p> <p><a href="a(b">foo</a></p>

The three exits now also require parens == 0. Valid destinations such as a(b) and inline links are unaffected.

Added SpecialInputTest.linkReferenceDefinitionWithUnbalancedParens; it fails before the change and passes after. mvn test passes, except that PathologicalTest.paragraphOfLinesThatTryBlockStarts hit its 3 s timeout once on a heavily loaded machine. That test is unrelated and passes when run on its own, on main as well as on this branch. spotless:check is clean.

Found by differential testing against cmark.

Copilot AI balanced review requested due to automatic review settings October 24, 2026 14:27

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants