From ca6d2b41a1a1558b31303c8582dd9f115b9966e3 Mon Sep 17 00:00:00 2001
From: Wleeaf <179125857+wleeaf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 14:19:05 +0000
Subject: [PATCH] Reject link reference definitions with unbalanced parentheses
 in the destination

---
 .../java/org/commonmark/internal/util/LinkScanner.java |  6 +++---
 .../java/org/commonmark/test/SpecialInputTest.java     | 10 ++++++++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/commonmark/src/main/java/org/commonmark/internal/util/LinkScanner.java b/commonmark/src/main/java/org/commonmark/internal/util/LinkScanner.java
index b8072ad26..f629f4da7 100644
--- a/commonmark/src/main/java/org/commonmark/internal/util/LinkScanner.java
+++ b/commonmark/src/main/java/org/commonmark/internal/util/LinkScanner.java
@@ -123,7 +123,7 @@ private static boolean scanLinkDestinationWithBalancedParens(Scanner scanner) {
             char c = scanner.peek();
             switch (c) {
                 case ' ':
-                    return !empty;
+                    return !empty && parens == 0;
                 case '\\':
                     scanner.next();
                     if (isEscapable(scanner.peek())) {
@@ -149,14 +149,14 @@ private static boolean scanLinkDestinationWithBalancedParens(Scanner scanner) {
                 default:
                     // or control character
                     if (Character.isISOControl(c)) {
-                        return !empty;
+                        return !empty && parens == 0;
                     }
                     scanner.next();
                     break;
             }
             empty = false;
         }
-        return true;
+        return parens == 0;
     }
 
     private static boolean isEscapable(char c) {
diff --git a/commonmark/src/test/java/org/commonmark/test/SpecialInputTest.java b/commonmark/src/test/java/org/commonmark/test/SpecialInputTest.java
index 43b7686c9..f1021d2ee 100644
--- a/commonmark/src/test/java/org/commonmark/test/SpecialInputTest.java
+++ b/commonmark/src/test/java/org/commonmark/test/SpecialInputTest.java
@@ -207,6 +207,16 @@ public void linkLabelWithBracket() {
                 """);
     }
 
+    @Test
+    public void linkReferenceDefinitionWithUnbalancedParens() {
+        // Parentheses in a link destination must be balanced, otherwise it's not a definition
+        assertRendering("[foo]: (", "<p>[foo]: (</p>\n");
+        assertRendering("[foo]: (\nbar", "<p>[foo]: (\nbar</p>\n");
+        assertRendering("[foo]: a(b\n\n[foo]", "<p>[foo]: a(b</p>\n<p>[foo]</p>\n");
+        assertRendering(
+                "[foo]: a(b) \"t\"\n\n[foo]", "<p><a href=\"a(b)\" title=\"t\">foo</a></p>\n");
+    }
+
     @Test
     public void linkLabelLength() {
         String label1 = "a".repeat(999);