Pathological inputs

[mity]

I have just took a look how commonmark.js deals with the pathological inputs in Cmark's pathological_tests.py and in recently reported Cmark bugs.

Below is list of commands generating input which, after copying into http://try.commonmark.org/, makes JS interpreter in Firefox or Chrome unresponsive for looong time, many of them even result in browser offering user to kill the script.

In vast majority of applications user may likely only DoS-attack his own browser so security impact of these is limited. Still, it should be fixed.

"Openers and closers multiple of 3":

python -c 'print(("a**b" + ("c* " * 50000)))'

(Fixed in CMark, see commonmark/cmark#178)

"Nested block quotes":

python -c 'print((("> " * 50000) + "a"))'

(Works in CMark)

"Backticks":

python -c 'print("".join(map(lambda x: ("e" + "`" * x), range(1,10000))))'

(Fixed in CMark, see commonmark/cmark@8ed5c9d)

"Unclosed inline links":

python -c 'print("[a](b" * 50000)'

Fixed in cmark: see commonmark/cmark#214

python -c 'print("[a](<b" * 50000)'

Broken in cmark: see commonmark/cmark#218.

"Many ref. definitions"

python -c 'print("[a]: u\n" * 16 * 50000)'

(Fixed in Cmark, see commonmark/cmark#232)