search

khajavi / pandoc

Automatically exported from code.google.com/p/pandoc
GNU General Public License v2.0
0 stars 0 forks source link

[Security] pandoc spends a very long time processing a particular input #181

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
$ pandoc --version
pandoc 1.2.1
Copyright (C) 2006-8 John MacFarlane
Web:  http://johnmacfarlane.net/pandoc
This is free software; see the source for copying conditions.  There is no
warranty, not even for merchantability or fitness for a particular purpose.
$ pandoc
[____________________]
[>>>>>>>>>>>>>>>>>>>>]
(press ctrl-D)

Pandoc takes a long time (about half a minute) to produce the output (which
seems to be correct).

Original issue reported on code.google.com by infinity0x@gmail.com on 28 Nov 2009 at 10:36

GoogleCodeExporter commented 9 years ago 
oh, i see the problem - the output is this:

<p
>[<strong
  >_</strong
  ><strong
  ><strong
    ><strong
      >_</strong
      ></strong
    ></strong
  >__]
[>>>>>>>>>>>>>>>>>>>>]</p
>

It must be using an exponential algorithm to parse "__________" etc...

Original comment by infinity0x@gmail.com on 28 Nov 2009 at 10:38

GoogleCodeExporter commented 9 years ago 
in retrospect the "[security]" tag I added is more appropriate for the gitit
application, rather than pandoc itself:
http://github.com/jgm/gitit/issues/?issue/6#issue/6

Original comment by infinity0x@gmail.com on 28 Nov 2009 at 10:41

GoogleCodeExporter commented 9 years ago 
extra notes:

pandoc can parse the following in a normal amount of time:

"[____________________]\n"
"[>>>>>>>>>>>>>>>>>>>>]\n"
"____________________\n"
">>>>>>>>>>>>>>>>>>>>\n"
"____________________\n>>>>>>>>>>>>>>>>>>>>\n"

(although the first one, "[____________________]\n" seems to have a slight lag 
on it)

$ pandoc
[____________________]
<p
>[<strong
  >_</strong
  ><strong
  ><strong
    ><strong
      >_</strong
      ></strong
    ></strong
  >__]</p
>
$ pandoc
[>>>>>>>>>>>>>>>>>>>>]
<p
>[>>>>>>>>>>>>>>>>>>>>]</p
>
$ pandoc
____________________
<hr
 />
$ pandoc
>>>>>>>>>>>>>>>>>>>>
<blockquote
><blockquote
  ><blockquote
    ><blockquote
      ><blockquote
    ><blockquote
      ><blockquote
        ><blockquote
          ><blockquote
        ><blockquote
          ><blockquote
            ><blockquote
              ><blockquote
            ><blockquote
              ><blockquote
                ><blockquote
                  ><blockquote
                ><blockquote
                  ><blockquote
                    ><blockquote
                      ></blockquote
                      ></blockquote
                    ></blockquote
                  ></blockquote
                ></blockquote
                  ></blockquote
                ></blockquote
              ></blockquote
            ></blockquote
              ></blockquote
            ></blockquote
          ></blockquote
        ></blockquote
          ></blockquote
        ></blockquote
      ></blockquote
    ></blockquote
      ></blockquote
    ></blockquote
  ></blockquote
>
$ pandoc
____________________
>>>>>>>>>>>>>>>>>>>>
<hr
 /><blockquote
><blockquote
  ><blockquote
    ><blockquote
      ><blockquote
    ><blockquote
      ><blockquote
        ><blockquote
          ><blockquote
        ><blockquote
          ><blockquote
            ><blockquote
              ><blockquote
            ><blockquote
              ><blockquote
                ><blockquote
                  ><blockquote
                ><blockquote
                  ><blockquote
                    ><blockquote
                      ></blockquote
                      ></blockquote
                    ></blockquote
                  ></blockquote
                ></blockquote
                  ></blockquote
                ></blockquote
              ></blockquote
            ></blockquote
              ></blockquote
            ></blockquote
          ></blockquote
        ></blockquote
          ></blockquote
        ></blockquote
      ></blockquote
    ></blockquote
      ></blockquote
    ></blockquote
  ></blockquote
>

Original comment by infinity0x@gmail.com on 28 Nov 2009 at 10:47

GoogleCodeExporter commented 9 years ago 
This problem is resolved in r1634, which causes pandoc to treat any string of 4 
or
more * or _ characters in a row as a literal string, rather than attempting to 
parse
as emph/strong.

Original comment by fiddloso...@gmail.com on 29 Nov 2009 at 7:33

GoogleCodeExporter commented 9 years ago 
hmm... but ______ could mean <hr/> in markdown?

Original comment by infinity0x@gmail.com on 30 Nov 2009 at 11:00

GoogleCodeExporter commented 9 years ago 
Only if it occurs in a block by itself, and that case is already taken care of.
You can try it yourself.

Original comment by fiddloso...@gmail.com on 30 Nov 2009 at 3:12