quantizor / markdown-to-jsx

🏭 The most lightweight, customizable React markdown component.
https://markdown-to-jsx.quantizor.dev/
MIT License
1.96k stars 169 forks source link

[Critical] Page freezes with this raw text #568

Closed yzhou88 closed 4 months ago

yzhou88 commented 5 months ago

This is a special string, paste it into https://markdown-to-jsx.quantizor.dev/, and the page freezes.

With Chrome: > 10 seconds freeze time With Safari: around 1 second freeze time

_model.rows[i].id}}|<a>{{page_model.rows[i].name}}</a>|{{page_model.rows[i].mobile}}|{{page_model.rows[i].mobile}}|{{page_model.rows[i].mobile}}|<Children name="mobile"/>|<Children name="email"/>|<Children name="mobile"/>|<Children name="address"/>|<Children name="address2"/>|<Cxhildren name="last_time"/>|<Children name="next_call"/>|<Children name="last_call"/>|<Children name="last_time"/>|<Children name="last_time"/>|<Children name="record"/>|<Children name="last_time"/>|<Children name="last_time"/>|<Children name="record"/>|

It is because this regExp is taking so much time: const TEXT_EMPHASIZED_R = /^([*_])((?:\[.*?\][([].*?[)\]]|<.*?>(?:.*?<.*?>)?|.?`|~+.?~+|.)*?)\1(?!\1|\w)/`

henrymcl commented 5 months ago

image

This is typical ReDOS.

Removing the final \w from (?!\1|\w) will resolve the issue but likely there will be implications.

quantizor commented 4 months ago

While removing that bit does improve the emphasis detection regex performance (at the cost of an underscore in the middle of a word tripping the detector, which is its own whole debate), there seems to be another issue happening as well because the inline regex is reaching across table header cells where it should be isolated per cell. I think that's the first culprit worth exploring here...

quantizor commented 4 months ago

This should be fixed with the most recent version

joehe00 commented 4 months ago

The chrome freeze issue still exist for the sting pasted above.