goldmark icon indicating copy to clipboard operation
goldmark copied to clipboard

Incorrect parsing leading to panic at render

Open Andrew-Morozko opened this issue 6 months ago • 0 comments

goldmark has https://github.com/yuin/goldmark/discussions in github. You should post only issues here. Feature requests and questions should be posted at discussions.

  • [x] goldmark is fully compliant with the CommonMark. Before submitting issue, you must read CommonMark spec and confirm your output is different from CommonMark online demo.
    • [x] Extensions(Autolink without < >, Table, etc) are not part of CommonMark spec. You should confirm your output is different from other official renderers correspond with an extension.
  • [x] goldmark is not dedicated for Hugo. If you are Hugo user and your issue was raised by your experience in Hugo, you should consider create issue at Hugo repository at first .

Please answer the following before submitting your issue:

  1. What version of goldmark are you using? : v1.7.4
  2. What version of Go are you using? : go1.22.5
  3. What operating system and processor architecture are you using? : darwin/amd64
  4. What did you do? : Rendered the string []byte("> ```\n>\t0")
  5. What did you expect to see? :
    <blockquote>
    <pre><code> 0
    </code></pre>
    </blockquote>
    
  6. What did you see instead? : panic: runtime error: slice bounds out of range [11:10]
  7. Did you confirm your output is different from CommonMark online demo or other official renderer correspond with an extension?: yep, no panics there

The panicky snippet was found by a fuzzer, but here's a non-panicking input that results in the wrong output

>  ```
>	0
>  ```

Result:

<blockquote>
<pre><code></code></pre>
</blockquote>

Expected:

<blockquote>
<pre><code> 0
</code></pre>
</blockquote>

As far as I understand, the issue is within this function, and it's complicated enough that I don't have a fix. Tab should be interpreted as 3 spaces (since it is in the second column), one space is consumed by the blockquote, another one - by the code block indentation, and we should be left with a single space preceding "0".

Andrew-Morozko avatar Aug 18 '24 09:08 Andrew-Morozko