Skip to content

cap nesting depth in MarkdownSlurper to avoid stack overflow#2711

Open
netliomax25-code wants to merge 1 commit into
apache:masterfrom
netliomax25-code:markdownslurper-nesting-depth
Open

cap nesting depth in MarkdownSlurper to avoid stack overflow#2711
netliomax25-code wants to merge 1 commit into
apache:masterfrom
netliomax25-code:markdownslurper-nesting-depth

Conversation

@netliomax25-code

Copy link
Copy Markdown
Contributor
  1. MarkdownSlurper walks the parsed CommonMark tree recursively (blocksToList/nodeToMap, and textOf/appendText) with one stack frame per nesting level and no depth bound.
  2. CommonMark builds that tree iteratively, so a small but deeply nested document (a single ~8 KB line of nested block quotes, or a deeply nested list) overflows the walk and raises a StackOverflowError inside parse()/parseText(). That raw Error escapes the documented MarkdownRuntimeException that callers guarding untrusted input catch.
  3. Added a configurable cap (maxNestingDepth, default 1000, property groovy.markdown.maxNestingDepth) checked once before the walk, throwing MarkdownRuntimeException past the limit, matching the nesting cap JsonSlurper already applies.

Validation: a 5000-deep block-quote input now throws MarkdownRuntimeException instead of overflowing, documents within the limit parse unchanged, and the added regression tests plus the existing MarkdownSlurper suite pass.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant