fix(block): avoid quadratic ref link scans

Author: lepture

src/mistune/block_parser.py

@@ -1,3 +1,4 @@
+from bisect import bisect_left
 import re
 from typing import Optional, List, Tuple, Match, Pattern, Set
 import string
@@ -256,11 +257,11 @@ def parse_ref_link(self, m: Match[str], state: BlockState) -> Optional[int]:
 
         assert href_pos is not None
 
-        _blank = self.BLANK_LINE.search(state.src, href_pos)
-        if _blank:
-            max_pos = _blank.start()
-        else:
+        blank_pos = _find_next_blank_line(state, href_pos, self.BLANK_LINE)
+        if blank_pos is None:
             max_pos = state.cursor_max
+        else:
+            max_pos = blank_pos
 
         title, title_pos = parse_link_title(state.src, href_pos, max_pos)
         if title_pos:
@@ -537,6 +538,19 @@ def _parse_block_quote_line(line: str) -> Optional[str]:
     return _BLOCK_QUOTE_TRIM.sub("", text)
 
 
+def _find_next_blank_line(state: BlockState, pos: int, pattern: Pattern[str]) -> Optional[int]:
+    cache = state.env.get("__blank_line_starts__")
+    if cache is None or cache[0] is not state.src:
+        cache = (state.src, [m.start() for m in pattern.finditer(state.src)])
+        state.env["__blank_line_starts__"] = cache
+
+    positions = cache[1]
+    index = bisect_left(positions, pos)
+    if index < len(positions):
+        return positions[index]
+    return None
+
+
 def _trim_partial_next_line_indent(text: str, end_pos: int) -> int:
     line_start = text.rfind("\n") + 1
     if line_start == 0:

tests/test_security_ref_links.py

@@ -0,0 +1,15 @@
+import time
+from unittest import TestCase
+
+from mistune import create_markdown
+
+
+class TestRefLinkSecurity(TestCase):
+    def test_many_reference_links_return_quickly(self):
+        text = "".join("[a{}]: u\n".format(i) for i in range(3000))
+
+        start = time.monotonic()
+        create_markdown()(text)
+        elapsed = time.monotonic() - start
+
+        self.assertLess(elapsed, 0.5)