Received: by mail.netbsd.org (Postfix, from userid 605) id A61D684E77; Sun, 21 Jan 2024 20:11:08 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id D4C0084D1B for ; Sun, 21 Jan 2024 20:11:07 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id DAGsxDtVK36x for ; Sun, 21 Jan 2024 20:11:06 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.NetBSD.org [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id BCAA784CCC for ; Sun, 21 Jan 2024 20:11:06 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id B2381FA42; Sun, 21 Jan 2024 20:11:06 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1705867866222420" MIME-Version: 1.0 Date: Sun, 21 Jan 2024 20:11:06 +0000 From: "Thomas Klausner" Subject: CVS commit: pkgsrc/textproc/md4c To: pkgsrc-changes@NetBSD.org Reply-To: wiz@netbsd.org X-Mailer: log_accum Message-Id: <20240121201106.B2381FA42@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1705867866222420 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: wiz Date: Sun Jan 21 20:11:06 UTC 2024 Modified Files: pkgsrc/textproc/md4c: Makefile distinfo Log Message: md4c: update to 0.5.1. ## Version 0.5.1 Changes: * LaTeX math extension (`MD_FLAG_LATEXMATHSPANS`) now requires that opener mark is not immediately preceded with alpha-numeric character and similarly that closer mark is not immediately followed with alpha-numeric character. So for example `foo$ x + y = z $` is not recognized as LaTeX equation anymore because there is no space between `foo` and the opening `$`. * Table extension (`MD_FLAG_TABLES`) now recognizes only tables with no more than 128 columns. This limit has been imposed to prevent a pathological case of quadratic output size explosion which could be used as DoS attack vector. * We are now more strict with `MD_FLAG_PERMISSIVExxxAUTOLINKS` family of extensions with respect to non-alphanumeric characters, with the aim to mitigate false positive detections. Only relatively few selected non-alphanumeric are now allowed in permissive e-mail auto-links (`MD_FLAG_PERMISSIVEEMAILAUTOLINKS`): - `.`, `-`, `_`, `+` in user name part of e-mail address; and - `.`, `-`, `_` in host part of the e-mail address. Similarly for URL and e-mail auto-links (`MD_FLAG_PERMISSIVEURLAUTOLINKS` and `MD_FLAG_PERMISSIVEWWWAUTOLINKS`): - `.`, `-`, `_` in host part of the URL; - `/`, `.`, `-`, `_` in path part of the URL; - `&`, `.`, `-`, `+`, `_`, `=`, `(`, `)` in the query part of the URL (additionally, if present, `(` and `)` must form balanced pairs); and - `.`, `-`, `+`, `_` in the fragment part of the URL. Furthermore these characters (with some exceptions like where they serve as delimiter characters, e.g. `/` for paths) are generally accepted only when an alphanumeric character both precedes and follows them (i.e. these cannot be "stacked" together). Fixes: * Fix several bugs where we haven't properly respected already resolved spans of higher precedence level in handling of permissive auto-links extensions (family of `MD_FLAG_PERMISSIVExxxAUTOLINKS` flags), LaTeX math extension (`MD_FLAG_LATEXMATHSPANS`) and wiki-links extension (`MD_FLAG_WIKILINKS`) of the form `[[label|text]]` (with pipe `|`). In some complex cases this could lead to invalid internal parser state and memory corruption. Identified with [OSS-Fuzz](https://github.com/google/oss-fuzz). * [#222](https://github.com/mity/md4c/issues/222): Fix strike-through extension (`MD_FLAG_STRIKETHROUGH`) which did not respect same rules for pairing opener and closer marks as other emphasis spans. * [#223](https://github.com/mity/md4c/issues/223): Fix incorrect handling of new-line character just at the beginning and/or end of a code span where we were not following CommonMark specification requirements correctly. ## Version 0.5.0 Changes: * Changes mandated by CommonMark specification 0.30. Actually there are only very minor changes to recognition of HTML blocks: - The tag `