fix: improve nested bracket link input

Author: lepture

src/mistune/core.py

@@ -130,6 +130,7 @@ def __init__(self, env: MutableMapping[str, Any]):
         self.in_image = False
         self.in_link = False
         self.no_close_bracket_before: int = 0  # high-water mark for DoS mitigation
+        self.no_link_before: int = 0  # high-water mark for failed balanced link candidates
         self.link_brackets: Dict[int, Tuple[str, Dict[int, int]]] = {}
 
     def prepend_token(self, token: Dict[str, Any]) -> None:

src/mistune/inline_parser.py

@@ -125,6 +125,9 @@ def parse_link(self, m: Match[str], state: InlineState) -> Optional[int]:
         if not is_image and state.in_link:
             state.append_token({"type": "text", "raw": marker})
             return pos
+        if not is_image and pos <= state.no_link_before:
+            state.append_token({"type": "text", "raw": marker})
+            return pos
 
         text = None
         label, end_pos = parse_link_label(state.src, pos)
@@ -144,11 +147,13 @@ def parse_link(self, m: Match[str], state: InlineState) -> Optional[int]:
             text = label
 
         assert text is not None
+        body_end_pos = end_pos
 
-        if end_pos >= len(state.src) and label is None:
+        has_nested_link = not is_image and self._contains_nested_link(text, state)
+        if has_nested_link:
             return None
-
-        if not is_image and self._contains_nested_link(text, state):
+        if end_pos >= len(state.src) and label is None:
+            _mark_no_link_before(state, body_end_pos)
             return None
 
         rules = ["codespan", "prec_auto_link", "prec_inline_html"]
@@ -175,10 +180,12 @@ def parse_link(self, m: Match[str], state: InlineState) -> Optional[int]:
                         label = label2
 
         if label is None:
+            _mark_no_link_before(state, body_end_pos)
             return None
 
         ref_links = state.env.get("ref_links")
         if not ref_links:
+            _mark_no_link_before(state, body_end_pos)
             return None
 
         key = unikey(label)
@@ -190,6 +197,7 @@ def parse_link(self, m: Match[str], state: InlineState) -> Optional[int]:
             token["label"] = label
             state.append_token(token)
             return end_pos
+        _mark_no_link_before(state, body_end_pos)
         return None
 
     def _contains_nested_link(self, text: str, state: InlineState) -> bool:
@@ -805,6 +813,11 @@ def _parse_link_text(state: InlineState, pos: int) -> Tuple[Optional[str], int]:
     return state.src[pos:close_pos], close_pos + 1
 
 
+def _mark_no_link_before(state: InlineState, end_pos: int) -> None:
+    if end_pos > state.no_link_before:
+        state.no_link_before = end_pos
+
+
 def _find_closing_bracket(state: InlineState, pos: int) -> Optional[int]:
     cache = state.link_brackets.get(id(state.src))
     if cache is not None and cache[0] is state.src:

tests/test_security_inline.py

@@ -17,7 +17,7 @@ def test_link_title_redos_payload_returns_quickly(self):
         self.assertIn("[x](y", html)
 
     def test_nested_bracket_link_input_does_not_recurse_forever(self):
-        text = "[" * 200 + "x" + "]" * 200
+        text = "[" * 8000 + "x" + "]" * 8000
 
         start = time.monotonic()
         html = create_markdown()(text)
@@ -26,6 +26,26 @@ def test_nested_bracket_link_input_does_not_recurse_forever(self):
         self.assertLess(elapsed, 0.5)
         self.assertIn("[", html)
 
+    def test_failed_outer_bracket_preserves_nested_link(self):
+        html = create_markdown()("[[x](https://example.com)]")
+
+        self.assertEqual('<p>[<a href="https://example.com">x</a>]</p>\n', html)
+
+    def test_failed_reference_after_nested_brackets_returns_quickly(self):
+        text = "[" * 8000 + "x" + "]" * 8000 + "[missing]"
+
+        start = time.monotonic()
+        html = create_markdown()(text)
+        elapsed = time.monotonic() - start
+
+        self.assertLess(elapsed, 0.5)
+        self.assertIn("[missing]", html)
+
+    def test_failed_reference_does_not_hide_following_inline_link(self):
+        html = create_markdown()("[foo][bar](https://example.com)")
+
+        self.assertEqual('<p>[foo]<a href="https://example.com">bar</a></p>\n', html)
+
     def test_unmatched_bracket_input_returns_quickly(self):
         text = "[" * 4000