Skip to content

Avoid backtracking in setext marker detection - #6

Merged
lepture merged 1 commit into
mainfrom
codex/fix-regex-to-avoid-backtracking-vulnerabilities
Jul 28, 2026
Merged

Avoid backtracking in setext marker detection#6
lepture merged 1 commit into
mainfrom
codex/fix-regex-to-avoid-backtracking-vulnerabilities

Conversation

@lepture

@lepture lepture commented Jul 28, 2026

Copy link
Copy Markdown
Owner

Motivation

  • The existing SETEXT_MARKER_RE used nested repetition which can exhibit catastrophic backtracking on long near-matches and lead to denial-of-service when processing attacker-controlled input.

Description

  • Replace the nested-repetition regex with an equivalent linear-time pattern in src/wenmode/renderers/markdown.py to prevent exponential backtracking.
  • Add tests in tests/test_renderers.py to cover spaced and unspaced setext markers and to exercise a long near-match to guard against regex DoS regressions.
  • Adjust rendering assertions to verify the expected escaped output and the safe handling of long non-setext markers.

Testing

  • Ran the renderer tests with PYTHONPATH=src uv run pytest tests/test_renderers.py -q which passed (106 passed).
  • Ran the full test suite with PYTHONPATH=src uv run pytest -q which passed (2303 passed).
  • Ran linting and static checks with uv run ruff check src/wenmode/renderers/markdown.py tests/test_renderers.py which reported no issues.
  • Ran type checks with PYTHONPATH=src uv run mypy which completed with no reported problems.

Codex Task

@lepture
lepture merged commit 4768c20 into main Jul 28, 2026
19 of 25 checks passed
@lepture
lepture deleted the codex/fix-regex-to-avoid-backtracking-vulnerabilities branch July 28, 2026 15:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant