fix: potential super-linear regular expressions (#463)

Improve regular expressions that could match in super-linear runtime for certain inputs.

Author: ericcornelissen

src/rules/no-duplicate-headings.js

@@ -36,7 +36,7 @@
  *
  * @see https://spec.commonmark.org/0.31.2/#example-76
  */
-const trailingAtxHeadingHashPattern = /[ \t]+#+[ \t]*$/u;
+const trailingAtxHeadingHashPattern = /(?<![ \t])[ \t]+#+[ \t]*$/u;
 const leadingAtxHeadingHashPattern = /^#{1,6}[ \t]+/u;
 
 //-----------------------------------------------------------------------------

src/rules/no-missing-label-refs.js

@@ -43,7 +43,7 @@ function findMissingReferences(node, nodeText) {
  * `right` is the content between the second brackets. It can be empty, and it can be undefined.
  */
 const labelPattern =
-/(?<!\\)\[(?<left>(?:\\.|[^\]])*)(?<!\\)\](?<!\\)(?:\[(?<right>(?:\\.|[^\]])*)(?<!\\)\])?/dgu;
+/(?<!\\)\[(?<left>(?:\\.|[^[\]])*)(?<!\\)\](?<!\\)(?:\[(?<right>(?:\\.|[^\]])*)(?<!\\)\])?/dgu;
 
 let match;
 

src/rules/no-missing-link-fragments.js

@@ -28,7 +28,7 @@ import GithubSlugger from "github-slugger";
 const githubLineReferencePattern = /^L\d+(?:C\d+)?(?:-L\d+(?:C\d+)?)?$/u;
 const customHeadingIdPattern = /\{#([^}\s]+)\}\s*$/u;
 const htmlCommentPattern = /<!--[\s\S]*?-->/gu;
-const htmlIdNamePattern = /<(?:[^>]+)\s+(?:id|name)=["']([^"']+)["']/giu;
+const htmlIdNamePattern = /(?<!<)<(?:[^>]+)\s(?:id|name)=["']([^"']+)["']/giu;
 
 /**
  * Checks if the fragment is a valid GitHub line reference

tests/rules/no-duplicate-headings.test.js

@@ -9,7 +9,7 @@
 
 import rule from "../../src/rules/no-duplicate-headings.js";
 import markdown from "../../src/index.js";
-import { RuleTester } from "eslint";
+import { Linter, RuleTester } from "eslint";
 import dedent from "dedent";
 
 //------------------------------------------------------------------------------
@@ -125,7 +125,7 @@ ruleTester.run("no-duplicate-headings", rule, {
 {
 code: dedent`
 # Heading 1
-
+
 # Heading 1 ##
  `,
 errors: [
@@ -141,7 +141,7 @@ ruleTester.run("no-duplicate-headings", rule, {
 {
 code: dedent`
 # Heading 1
-
+
 # Heading 1 ##########
  `,
 errors: [
@@ -378,3 +378,13 @@ Heading 1
 },
 ],
 });
+
+// https://github.com/eslint/markdown/pull/463
+it("`no-duplicate-headings` should not timeout for large inputs", () => {
+const linter = new Linter();
+linter.verify(`# example${" ".repeat(500_000)}?#`, {
+language: "markdown/commonmark",
+plugins: { markdown },
+rules: { "markdown/no-duplicate-headings": "error" },
+});
+});

tests/rules/no-missing-label-refs.test.js

@@ -9,7 +9,7 @@
 
 import rule from "../../src/rules/no-missing-label-refs.js";
 import markdown from "../../src/index.js";
-import { RuleTester } from "eslint";
+import { Linter, RuleTester } from "eslint";
 
 //------------------------------------------------------------------------------
 // Tests
@@ -383,3 +383,13 @@ ruleTester.run("no-missing-label-refs", rule, {
 },
 ],
 });
+
+// https://github.com/eslint/markdown/pull/463
+it("`no-missing-label-refs` should not timeout for large inputs", () => {
+const linter = new Linter();
+linter.verify("[abcd".repeat(100_000), {
+language: "markdown/commonmark",
+plugins: { markdown },
+rules: { "markdown/no-missing-label-refs": "error" },
+});
+});

tests/rules/no-missing-link-fragments.test.js

@@ -9,7 +9,7 @@
 
 import rule from "../../src/rules/no-missing-link-fragments.js";
 import markdown from "../../src/index.js";
-import { RuleTester } from "eslint";
+import { Linter, RuleTester } from "eslint";
 import dedent from "dedent";
 
 //------------------------------------------------------------------------------
@@ -658,3 +658,20 @@ ruleTester.run("no-missing-link-fragments", rule, {
 },
 ],
 });
+
+// https://github.com/eslint/markdown/pull/463
+it("`no-missing-link-fragments` should not timeout for large inputs", () => {
+const inputs = [
+`<div>${"<".repeat(500_000)}x</div>`,
+`<div><${" ".repeat(500_000)}x</div>`,
+];
+
+const linter = new Linter();
+for (const input of inputs) {
+linter.verify(input, {
+language: "markdown/commonmark",
+plugins: { markdown },
+rules: { "markdown/no-missing-link-fragments": "error" },
+});
+}
+});