qiita_marker 0.23.2.3 → 0.23.5.0

data/ext/qiita_marker/table.c

@@ -129,6 +129,7 @@ static table_row *row_from_string(cmark_syntax_extension *self,
   bufsize_t cell_matched = 1, pipe_matched = 1, offset;
   int expect_more_cells = 1;
   int row_end_offset = 0;
+  int int_overflow_abort = 0;
 
   row = (table_row *)parser->mem->calloc(1, sizeof(table_row));
   row->n_columns = 0;
@@ -161,6 +162,12 @@ static table_row *row_from_string(cmark_syntax_extension *self,
         ++cell->internal_offset;
       }
 
+      // make sure we never wrap row->n_columns
+      // offset will != len and our exit will clean up as intended
+      if (row->n_columns == UINT16_MAX) {
+          int_overflow_abort = 1;
+          break;
+      }
       row->n_columns += 1;
       row->cells = cmark_llist_append(parser->mem, row->cells, cell);
     }
@@ -194,7 +201,7 @@ static table_row *row_from_string(cmark_syntax_extension *self,
     }
   }
 
-  if (offset != len || row->n_columns == 0) {
+  if (offset != len || row->n_columns == 0 || int_overflow_abort) {
     free_table_row(parser->mem, row);
     row = NULL;
   }
@@ -241,6 +248,11 @@ static cmark_node *try_opening_table_header(cmark_syntax_extension *self,
   marker_row = row_from_string(self, parser,
                                input + cmark_parser_get_first_nonspace(parser),
                                len - cmark_parser_get_first_nonspace(parser));
+  // assert may be optimized out, don't rely on it for security boundaries
+  if (!marker_row) {
+      return parent_container;
+  }
+  
   assert(marker_row);
 
   cmark_arena_push();
@@ -264,6 +276,12 @@ static cmark_node *try_opening_table_header(cmark_syntax_extension *self,
         len - cmark_parser_get_first_nonspace(parser));
     header_row = row_from_string(self, parser, (unsigned char *)parent_string,
                                  (int)strlen(parent_string));
+    // row_from_string can return NULL, add additional check to ensure n_columns match
+    if (!marker_row || !header_row || header_row->n_columns != marker_row->n_columns) {
+        free_table_row(parser->mem, marker_row);
+        free_table_row(parser->mem, header_row);
+        return parent_container;
+    }
   }
 
   if (!cmark_node_set_type(parent_container, CMARK_NODE_TABLE)) {
@@ -281,8 +299,10 @@ static cmark_node *try_opening_table_header(cmark_syntax_extension *self,
   parent_container->as.opaque = parser->mem->calloc(1, sizeof(node_table));
   set_n_table_columns(parent_container, header_row->n_columns);
 
+  // allocate alignments based on marker_row->n_columns
+  // since we populate the alignments array based on marker_row->cells
   uint8_t *alignments =
-      (uint8_t *)parser->mem->calloc(header_row->n_columns, sizeof(uint8_t));
+      (uint8_t *)parser->mem->calloc(marker_row->n_columns, sizeof(uint8_t));
   cmark_llist *it = marker_row->cells;
   for (i = 0; it; it = it->next, ++i) {
     node_cell *node = (node_cell *)it->data;
@@ -351,6 +371,12 @@ static cmark_node *try_opening_table_row(cmark_syntax_extension *self,
   row = row_from_string(self, parser, input + cmark_parser_get_first_nonspace(parser),
       len - cmark_parser_get_first_nonspace(parser));
 
+  if (!row) {
+      // clean up the dangling node
+      cmark_node_free(table_row_block);
+      return NULL;
+  }
+
   {
     cmark_llist *tmp;
     int i, table_columns = get_n_table_columns(parent_container);

data/lib/qiita_marker/config.rb

@@ -15,7 +15,7 @@ module QiitaMarker
         FOOTNOTES: (1 << 13),
         STRIKETHROUGH_DOUBLE_TILDE: (1 << 14),
         MENTION_NO_EMPHASIS: (1 << 26),
-        AUTOLINK_CLASS_NAME: (1 << 27)
+        AUTOLINK_CLASS_NAME: (1 << 27),
       }.freeze,
       render: {
         DEFAULT: 0,
@@ -33,9 +33,9 @@ module QiitaMarker
         FULL_INFO_STRING: (1 << 16),
         CODE_DATA_METADATA: (1 << 25),
         MENTION_NO_EMPHASIS: (1 << 26),
-        AUTOLINK_CLASS_NAME: (1 << 27)
+        AUTOLINK_CLASS_NAME: (1 << 27),
       }.freeze,
-      format: %i[html xml commonmark plaintext].freeze
+      format: [:html, :xml, :commonmark, :plaintext].freeze,
     }.freeze
 
     def self.process_options(option, type)

data/lib/qiita_marker/node/inspect.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'pp'
+require "pp"
 
 module QiitaMarker
   class Node
@@ -8,33 +8,23 @@ module QiitaMarker
       PP_INDENT_SIZE = 2
 
       def inspect
-        PP.pp(self, +'', Float::INFINITY)
+        PP.pp(self, +"", Float::INFINITY)
       end
 
       # @param printer [PrettyPrint] pp
       def pretty_print(printer)
-        printer.group(PP_INDENT_SIZE, "#<#{self.class}(#{type}):", '>') do
+        printer.group(PP_INDENT_SIZE, "#<#{self.class}(#{type}):", ">") do
           printer.breakable
 
-          attrs = %i[
-            sourcepos
-            string_content
-            url
-            title
-            header_level
-            list_type
-            list_start
-            list_tight
-            fence_info
-          ].map do |name|
+          attrs = [:sourcepos, :string_content, :url, :title, :header_level, :list_type, :list_start, :list_tight, :fence_info].map do |name|
             [name, __send__(name)]
           rescue NodeError
             nil
           end.compact
 
           printer.seplist(attrs) do |name, value|
-            printer.text "#{name}="
-            printer.pp value
+            printer.text("#{name}=")
+            printer.pp(value)
           end
 
           if first_child
@@ -46,8 +36,8 @@ module QiitaMarker
                 children << node
                 node = node.next
               end
-              printer.text 'children='
-              printer.pp children
+              printer.text("children=")
+              printer.pp(children)
             end
           end
         end

data/lib/qiita_marker/node.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'qiita_marker/node/inspect'
+require "qiita_marker/node/inspect"
 
 module QiitaMarker
   class Node
@@ -27,7 +27,7 @@ module QiitaMarker
     # Returns a {String}.
     def to_html(options = :DEFAULT, extensions = [])
       opts = Config.process_options(options, :render)
-      _render_html(opts, extensions).force_encoding('utf-8')
+      _render_html(opts, extensions).force_encoding("utf-8")
     end
 
     # Public: Convert the node to an XML string.
@@ -37,7 +37,7 @@ module QiitaMarker
     # Returns a {String}.
     def to_xml(options = :DEFAULT)
       opts = Config.process_options(options, :render)
-      _render_xml(opts).force_encoding('utf-8')
+      _render_xml(opts).force_encoding("utf-8")
     end
 
     # Public: Convert the node to a CommonMark string.
@@ -48,7 +48,7 @@ module QiitaMarker
     # Returns a {String}.
     def to_commonmark(options = :DEFAULT, width = 120)
       opts = Config.process_options(options, :render)
-      _render_commonmark(opts, width).force_encoding('utf-8')
+      _render_commonmark(opts, width).force_encoding("utf-8")
     end
 
     # Public: Convert the node to a plain text string.
@@ -59,7 +59,7 @@ module QiitaMarker
     # Returns a {String}.
     def to_plaintext(options = :DEFAULT, width = 120)
       opts = Config.process_options(options, :render)
-      _render_plaintext(opts, width).force_encoding('utf-8')
+      _render_plaintext(opts, width).force_encoding("utf-8")
     end
 
     # Public: Iterate over the children (if any) of the current pointer.
@@ -76,7 +76,7 @@ module QiitaMarker
 
     # Deprecated: Please use `each` instead
     def each_child(&block)
-      warn '[DEPRECATION] `each_child` is deprecated.  Please use `each` instead.'
+      warn("[DEPRECATION] `each_child` is deprecated.  Please use `each` instead.")
       each(&block)
     end
   end

data/lib/qiita_marker/renderer/html_renderer.rb

@@ -9,8 +9,8 @@ module QiitaMarker
 
     def header(node)
       block do
-        out('<h', node.header_level, "#{sourcepos(node)}>", :children,
-            '</h', node.header_level, '>')
+        out("<h", node.header_level, "#{sourcepos(node)}>", :children,
+          "</h", node.header_level, ">")
       end
     end
 
@@ -19,10 +19,10 @@ module QiitaMarker
         out(:children)
       else
         block do
-          container("<p#{sourcepos(node)}>", '</p>') do
+          container("<p#{sourcepos(node)}>", "</p>") do
             out(:children)
             if node.parent.type == :footnote_definition && node.next.nil?
-              out(' ')
+              out(" ")
               out_footnote_backref
             end
           end
@@ -36,16 +36,16 @@ module QiitaMarker
 
       block do
         if node.list_type == :bullet_list
-          container("<ul#{sourcepos(node)}>\n", '</ul>') do
+          container("<ul#{sourcepos(node)}>\n", "</ul>") do
             out(:children)
           end
         else
           start = if node.list_start == 1
-                    "<ol#{sourcepos(node)}>\n"
-                  else
-                    "<ol start=\"#{node.list_start}\"#{sourcepos(node)}>\n"
-                  end
-          container(start, '</ol>') do
+            "<ol#{sourcepos(node)}>\n"
+          else
+            "<ol start=\"#{node.list_start}\"#{sourcepos(node)}>\n"
+          end
+          container(start, "</ol>") do
             out(:children)
           end
         end
@@ -57,26 +57,26 @@ module QiitaMarker
     def list_item(node)
       block do
         tasklist_data = tasklist(node)
-        container("<li#{sourcepos(node)}#{tasklist_data}>#{' ' if tasklist?(node)}", '</li>') do
+        container("<li#{sourcepos(node)}#{tasklist_data}>#{" " if tasklist?(node)}", "</li>") do
           out(:children)
         end
       end
     end
 
     def tasklist(node)
-      return '' unless tasklist?(node)
+      return "" unless tasklist?(node)
 
       state = if checked?(node)
-                'checked="" disabled=""'
-              else
-                'disabled=""'
-              end
+        'checked="" disabled=""'
+      else
+        'disabled=""'
+      end
       "><input type=\"checkbox\" #{state} /"
     end
 
     def blockquote(node)
       block do
-        container("<blockquote#{sourcepos(node)}>\n", '</blockquote>') do
+        container("<blockquote#{sourcepos(node)}>\n", "</blockquote>") do
           out(:children)
         end
       end
@@ -93,21 +93,21 @@ module QiitaMarker
         if option_enabled?(:GITHUB_PRE_LANG)
           out("<pre#{sourcepos(node)}")
           out(' lang="', node.fence_info.split(/\s+/)[0], '"') if node.fence_info && !node.fence_info.empty?
-          out('><code>')
+          out("><code>")
         elsif option_enabled?(:CODE_DATA_METADATA)
           out("<pre#{sourcepos(node)}><code")
           out(' data-metadata="', node.fence_info, '"') if node.fence_info && !node.fence_info.empty?
-          out('>')
+          out(">")
         else
           out("<pre#{sourcepos(node)}><code")
           if node.fence_info && !node.fence_info.empty?
             out(' class="language-', node.fence_info.split(/\s+/)[0], '">')
           else
-            out('>')
+            out(">")
           end
         end
         out(escape_html(node.string_content))
-        out('</code></pre>')
+        out("</code></pre>")
       end
     end
 
@@ -116,7 +116,7 @@ module QiitaMarker
         if option_enabled?(:UNSAFE)
           out(tagfilter(node.string_content))
         else
-          out('<!-- raw HTML omitted -->')
+          out("<!-- raw HTML omitted -->")
         end
       end
     end
@@ -125,22 +125,22 @@ module QiitaMarker
       if option_enabled?(:UNSAFE)
         out(tagfilter(node.string_content))
       else
-        out('<!-- raw HTML omitted -->')
+        out("<!-- raw HTML omitted -->")
       end
     end
 
     def emph(_)
-      out('<em>', :children, '</em>')
+      out("<em>", :children, "</em>")
     end
 
     def strong(_)
-      out('<strong>', :children, '</strong>')
+      out("<strong>", :children, "</strong>")
     end
 
     def link(node)
-      out('<a href="', node.url.nil? ? '' : escape_href(node.url), '"')
+      out('<a href="', node.url.nil? ? "" : escape_href(node.url), '"')
       out(' title="', escape_html(node.title), '"') if node.title && !node.title.empty?
-      out('>', :children, '</a>')
+      out(">", :children, "</a>")
     end
 
     def image(node)
@@ -149,7 +149,7 @@ module QiitaMarker
         out(' alt="', :children, '"')
       end
       out(' title="', escape_html(node.title), '"') if node.title && !node.title.empty?
-      out(' />')
+      out(" />")
     end
 
     def text(node)
@@ -157,9 +157,9 @@ module QiitaMarker
     end
 
     def code(node)
-      out('<code>')
+      out("<code>")
       out(escape_html(node.string_content))
-      out('</code>')
+      out("</code>")
     end
 
     def linebreak(_node)
@@ -170,7 +170,7 @@ module QiitaMarker
       if option_enabled?(:HARDBREAKS)
         out("<br />\n")
       elsif option_enabled?(:NOBREAKS)
-        out(' ')
+        out(" ")
       else
         out("\n")
       end
@@ -203,17 +203,17 @@ module QiitaMarker
 
     def table_cell(node)
       align = case @alignments[@column_index]
-              when :left then ' align="left"'
-              when :right then ' align="right"'
-              when :center then ' align="center"'
-              else; ''
-              end
+      when :left then ' align="left"'
+      when :right then ' align="right"'
+      when :center then ' align="center"'
+      else; ""
+      end
       out(@in_header ? "<th#{align}#{sourcepos(node)}>" : "<td#{align}#{sourcepos(node)}>", :children, @in_header ? "</th>\n" : "</td>\n")
       @column_index += 1
     end
 
     def strikethrough(_)
-      out('<del>', :children, '</del>')
+      out("<del>", :children, "</del>")
     end
 
     def footnote_reference(node)
@@ -246,7 +246,7 @@ module QiitaMarker
     end
 
     def tasklist?(node)
-      node.type_string == 'tasklist'
+      node.type_string == "tasklist"
     end
 
     def checked?(node)

data/lib/qiita_marker/renderer.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require 'set'
-require 'stringio'
+require "set"
+require "stringio"
 
 module QiitaMarker
   class Renderer
@@ -9,9 +9,9 @@ module QiitaMarker
 
     def initialize(options: :DEFAULT, extensions: [])
       @opts = Config.process_options(options, :render)
-      @stream = StringIO.new(+'')
+      @stream = StringIO.new(+"")
       @need_blocksep = false
-      @warnings = Set.new []
+      @warnings = Set.new([])
       @in_tight = false
       @in_plain = false
       @tagfilter = extensions.include?(:tagfilter)
@@ -121,7 +121,7 @@ module QiitaMarker
     end
 
     def sourcepos(node)
-      return '' unless option_enabled?(:SOURCEPOS)
+      return "" unless option_enabled?(:SOURCEPOS)
 
       s = node.sourcepos
       " data-sourcepos=\"#{s[:start_line]}:#{s[:start_column]}-" \

data/lib/qiita_marker/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module QiitaMarker
-  VERSION = '0.23.2.3'
+  VERSION = "0.23.5.0"
 end

data/lib/qiita_marker.rb

@@ -1,15 +1,15 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require 'qiita_marker/qiita_marker'
-require 'qiita_marker/config'
-require 'qiita_marker/node'
-require 'qiita_marker/renderer'
-require 'qiita_marker/renderer/html_renderer'
-require 'qiita_marker/version'
+require "qiita_marker/qiita_marker"
+require "qiita_marker/config"
+require "qiita_marker/node"
+require "qiita_marker/renderer"
+require "qiita_marker/renderer/html_renderer"
+require "qiita_marker/version"
 
 begin
-  require 'awesome_print'
+  require "awesome_print"
 rescue LoadError; end # rubocop:disable Lint/SuppressedException
 module QiitaMarker
   # Public:  Parses a Markdown string into an HTML string.
@@ -23,9 +23,7 @@ module QiitaMarker
     raise TypeError, "text must be a String; got a #{text.class}!" unless text.is_a?(String)
 
     opts = Config.process_options(options, :render)
-    text = text.encode('UTF-8')
-    html = Node.markdown_to_html(text, opts, extensions)
-    html.force_encoding('UTF-8')
+    Node.markdown_to_html(text.encode("UTF-8"), opts, extensions)
   end
 
   # Public: Parses a Markdown string into a `document` node.
@@ -39,7 +37,7 @@ module QiitaMarker
     raise TypeError, "text must be a String; got a #{text.class}!" unless text.is_a?(String)
 
     opts = Config.process_options(options, :parse)
-    text = text.encode('UTF-8')
+    text = text.encode("UTF-8")
     Node.parse_document(text, text.bytesize, opts, extensions)
   end
 end

data/qiita_marker.gemspec

@@ -1,40 +1,38 @@
 # frozen_string_literal: true
 
-lib = File.expand_path('lib', __dir__)
+lib = File.expand_path("lib", __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require 'qiita_marker/version'
+require "qiita_marker/version"
 
 Gem::Specification.new do |s|
-  s.name = 'qiita_marker'
+  s.name = "qiita_marker"
   s.version = QiitaMarker::VERSION
-  s.summary = 'Qiita Marker is a Ruby library for Markdown processing, based on CommonMarker.'
-  s.description = 'A Ruby library that is the core module of the Qiita-specified markdown processor.'
-  s.authors = ['Qiita Inc.']
-  s.homepage = 'https://github.com/increments/qiita_marker'
-  s.license = 'MIT'
+  s.summary = "Qiita Marker is a Ruby library for Markdown processing, based on CommonMarker."
+  s.description = "A Ruby library that is the core module of the Qiita-specified markdown processor."
+  s.authors = ["Qiita Inc."]
+  s.homepage = "https://github.com/increments/qiita_marker"
+  s.license = "MIT"
 
-  s.files         = %w[LICENSE.txt README.md Rakefile qiita_marker.gemspec bin/qiita_marker]
-  s.files        += Dir.glob('lib/**/*.rb')
-  s.files        += Dir.glob('ext/qiita_marker/*.*')
-  s.test_files    = Dir.glob('test/**/*').reject { |f| f == 'test/benchinput.md' || f.start_with?('test/progit/') }
-  s.extensions    = ['ext/qiita_marker/extconf.rb']
+  s.files         = ["LICENSE.txt", "README.md", "Rakefile", "qiita_marker.gemspec", "bin/qiita_marker"]
+  s.files        += Dir.glob("lib/**/*.rb")
+  s.files        += Dir.glob("ext/qiita_marker/*.*")
+  s.extensions    = ["ext/qiita_marker/extconf.rb"]
 
-  s.executables = ['qiita_marker']
-  s.require_paths = %w[lib ext]
-  s.required_ruby_version = ['>= 2.6', '< 4.0']
+  s.executables = ["qiita_marker"]
+  s.require_paths = ["lib", "ext"]
+  s.required_ruby_version = [">= 2.6", "< 4.0"]
 
-  s.rdoc_options += ['-x', 'ext/qiita_marker/cmark/.*']
+  s.metadata["rubygems_mfa_required"] = "true"
 
-  s.add_development_dependency 'awesome_print'
-  s.add_development_dependency 'json', '~> 2.3'
-  s.add_development_dependency 'minitest', '~> 5.6'
-  s.add_development_dependency 'minitest-focus', '~> 1.1'
-  s.add_development_dependency 'rake'
-  s.add_development_dependency 'rake-compiler', '~> 0.9'
-  s.add_development_dependency 'rdoc', '~> 6.2'
-  s.add_development_dependency 'rubocop'
-  s.add_development_dependency 'rubocop-standard'
-  s.metadata = {
-    'rubygems_mfa_required' => 'true'
-  }
+  s.rdoc_options += ["-x", "ext/qiita_marker/cmark/.*"]
+
+  s.add_development_dependency("awesome_print")
+  s.add_development_dependency("json", "~> 2.3")
+  s.add_development_dependency("minitest", "~> 5.6")
+  s.add_development_dependency("minitest-focus", "~> 1.1")
+  s.add_development_dependency("rake")
+  s.add_development_dependency("rake-compiler", "~> 0.9")
+  s.add_development_dependency("rdoc", "~> 6.2")
+  s.add_development_dependency("rubocop")
+  s.add_development_dependency("rubocop-standard")
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: qiita_marker
 version: !ruby/object:Gem::Version
-  version: 0.23.2.3
+  version: 0.23.5.0
 platform: ruby
 authors:
 - Qiita Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-03-04 00:00:00.000000000 Z
+date: 2022-06-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: awesome_print
@@ -236,36 +236,6 @@ files:
 - lib/qiita_marker/renderer/html_renderer.rb
 - lib/qiita_marker/version.rb
 - qiita_marker.gemspec
-- test/benchmark.rb
-- test/fixtures/curly.md
-- test/fixtures/dingus.md
-- test/fixtures/strong.md
-- test/fixtures/table.md
-- test/test_attributes.rb
-- test/test_basics.rb
-- test/test_commands.rb
-- test/test_commonmark.rb
-- test/test_doc.rb
-- test/test_encoding.rb
-- test/test_extensions.rb
-- test/test_footnotes.rb
-- test/test_gc.rb
-- test/test_helper.rb
-- test/test_linebreaks.rb
-- test/test_maliciousness.rb
-- test/test_node.rb
-- test/test_options.rb
-- test/test_pathological_inputs.rb
-- test/test_plaintext.rb
-- test/test_qfm_autolink_class_name.rb
-- test/test_qfm_code_data_metadata.rb
-- test/test_qfm_custom_block.rb
-- test/test_qfm_mention_no_emphasis.rb
-- test/test_renderer.rb
-- test/test_smartpunct.rb
-- test/test_spec.rb
-- test/test_tasklists.rb
-- test/test_xml.rb
 homepage: https://github.com/increments/qiita_marker
 licenses:
 - MIT
@@ -296,34 +266,4 @@ rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: Qiita Marker is a Ruby library for Markdown processing, based on CommonMarker.
-test_files:
-- test/benchmark.rb
-- test/fixtures/curly.md
-- test/fixtures/dingus.md
-- test/fixtures/strong.md
-- test/fixtures/table.md
-- test/test_attributes.rb
-- test/test_basics.rb
-- test/test_commands.rb
-- test/test_commonmark.rb
-- test/test_doc.rb
-- test/test_encoding.rb
-- test/test_extensions.rb
-- test/test_footnotes.rb
-- test/test_gc.rb
-- test/test_helper.rb
-- test/test_linebreaks.rb
-- test/test_maliciousness.rb
-- test/test_node.rb
-- test/test_options.rb
-- test/test_pathological_inputs.rb
-- test/test_plaintext.rb
-- test/test_qfm_autolink_class_name.rb
-- test/test_qfm_code_data_metadata.rb
-- test/test_qfm_custom_block.rb
-- test/test_qfm_mention_no_emphasis.rb
-- test/test_renderer.rb
-- test/test_smartpunct.rb
-- test/test_spec.rb
-- test/test_tasklists.rb
-- test/test_xml.rb
+test_files: []