A backtick in code in a link parses incorrectly

[leafac]

Marked

CommonMark

It used to work in Marked 0.6.3

[UziTech]

There was a security issue with backticks in links as shown in #1493 and fixed in #1515 Released in v0.7.0

[leafac]

Can I help to fix this?

[UziTech]

Of course! PRs are always welcome.

[leafac]

I should have said: Can you please help me fix this?

I’m new to the codebase and have no idea where to start.

[UziTech]

You will most likely have to change the regex for links in rules.js and update the link tokenizer in Tokenizer.js.

If you have any questions about anything feel free to ask.

[leafac]

I thought I’d have time to work on this, but I won’t. If someone else can take this, it’d be great 😃

[pgcalixto]

Hey guys, I got here by looking for projects to contribute to during the Hacktoberfest. I opened a pull request to address this issue: #1794.

@UziTech, I updated the links in rules.js but apparently didn't need to update Tokenizer.js.

The PR passed all tests and I was looking where I could include a test case for this scenario of backticks in links.
However, as I inspected tests/specs/commonmark and tests/specs/gfm, the test cases seem to be based on examples from the CommonMark and GitHub specs, and do not support custom test cases.

Is there a test file where this scenario could be added?

[UziTech]

test/specs/new is where you will need to add tests.

[basilaiman]

Hi everyone! 👋

I came across this issue while participating in Hacktoberfest and would love to help fix it. I've opened PR #3783 that addresses the problem. I would appreciate if you can add the Hacktoberfest label

The fix ensures that links containing code spans with backticks are now parsed correctly according to the CommonMark spec.

All tests are passing, including the existing test cases and the new REDOS tests I added to ensure the regex patterns perform well even with edge cases like 100+ consecutive backticks.

Would appreciate any feedback or review! Thanks for maintaining such a great project.