[markdown] Check URL boundary before matching in AutolinkExtensionSyntax by jonasfj · Pull Request #2786 · dart-lang/tools

jonasfj · 2026-11-04T11:43:18Z

In AutolinkExtensionSyntax.tryMatch, check _validPrecedingChars before
running the combined URL+email pattern, falling back to _emailOnly when a
URL autolink cannot start at startMatchPos.

Why this change is necessary

AutolinkExtensionSyntax implements GFM extended autolinks by combining
_linkPattern (URL autolinks) and _emailPattern (email autolinks) into a
single pattern = RegExp('($_linkPattern)|($_emailPattern)').

Previously, tryMatch ran the full pattern.matchAsPrefix(parser.source, startMatchPos) at every candidate position and only checked whether a URL match
was preceded by a valid boundary character (\n, ' ', '*', '_', '~',
'(', '>') after pattern.matchAsPrefix succeeded. When a URL prefix like
www. or http:// appeared immediately after an invalid preceding character
(such as /www.a.b repeated or awww.example.com), tryMatch still matched
_linkPattern to the end of the line via [^\s<]*[^\s<?!.,:*_~] at every
candidate position only to reject it afterward, taking O(n^2) time.

How this change works

Before matching, tryMatch checks in O(1) time whether startMatchPos == 0
or parser.charAt(startMatchPos - 1) is in _validPrecedingChars.
When validLinkStart is false, tryMatch runs _emailOnly.matchAsPrefix
(RegExp(_emailPattern, multiLine: true, caseSensitive: false)), skipping
_linkPattern. In tryMatch and onMatch, an email match is identified by
!validLinkStart || startMatch[2] != null and
match.pattern == _emailOnly || match[2] != null.

Behavior change

An extended email autolink is now recognized at a position where a URL
autolink is not allowed to start. Before, the combined URL/email pattern was
run first and, when the URL alternative matched but the preceding character
was not a valid autolink start, the whole match was discarded without trying
the email alternative, so /[email protected] linked [email protected] one character
later. Now /[email protected] links the whole [email protected], which is also what
cmark-gfm does. URL autolinks are unchanged.

Differential testing

Rendered every input with origin/main and with this branch (GFM extension
set, 30 s per-file timeout) and compared the HTML. Sources:

pub.dev: 367,926 Markdown files from 93,452 packages
Real-world docs: 116,231 files from mdn/content, github/docs,
kubernetes/website, freeCodeCamp, tldr, flutter/website,
dart-lang/site-www, microsoft/vscode-docs, withastro/docs,
rust-lang/book, GitHub READMEs, and Wikipedia
Repository READMEs: 491,134 unique READMEs across GitHub, PyPI, HuggingFace,
and npm
Parser test suites: 6,458 cases from cmark, cmark-gfm, commonmark.js,
pulldown-cmark, md4c, goldmark, markdown-it, comrak, marked,
pandoc, and pathological generators
OSS-Fuzz: 57,716 inputs from the cmark, md4c, and markdown-it-py fuzzers

OSS-Fuzz inputs that sit at the 30 s timeout or the stack limit flip between
runs; every one reported as a new failure was re-run standalone on both trees.

Results:

Rendered HTML differs for 2 OSS-Fuzz inputs, both the shape above: a tab
followed by [email protected], previously w<a href="mailto:[email protected]">,
now <a href="mailto:[email protected]">.
No differences in pub.dev, the real-world docs, the repository READMEs, or
the parser test suites. No new exceptions; 3 OSS-Fuzz timeouts resolved.
Cumulative parse time −2.9%.

github-actions · 2026-11-04T11:45:04Z

PR Health

Publish ✔️

Package	Version	Status	Publish tag (post-merge)
package:markdown ⭐	7.4.1-wip	WIP (no publish necessary)

16 already published.
26 WIP (no publish necessary).

Documentation at https://github.com/dart-lang/ecosystem/wiki/Publishing-automation.

This check can be disabled by tagging the PR with skip-publish-check.

Changelog Entry ✔️

Package	Changed Files

Changes to files need to be accounted for in their respective changelogs.

This check can be disabled by tagging the PR with skip-changelog-check (for example, for non-user-visible changes when the package version is already at -wip).

Breaking changes ✔️

Package	Change	Current Version	New Version	Needed Version	Looking good?
markdown	Non-Breaking	7.3.1	7.4.1-wip	7.4.1-wip	✔️

This check can be disabled by tagging the PR with skip-breaking-check.

API leaks ✔️

The following packages contain symbols visible in the public API, but not exported by the library. Export these symbols or remove them from your publicly visible API.

Package	Leaked API symbol	Leaking sources

This check can be disabled by tagging the PR with skip-leaking-check.

Unused Dependencies ✔️

Package	Status
markdown	✔️ All dependencies utilized correctly.

For details on how to fix these, see dependency_validator.

This check can be disabled by tagging the PR with skip-unused-dependencies-check.

License Headers ✔️

// Copyright (c) 2026, the Dart project authors. Please see the AUTHORS file
// for details. All rights reserved. Use of this source code is governed by a
// BSD-style license that can be found in the LICENSE file.

Files
no missing headers

All source files should start with a license header.

Unrelated files missing license headers

Files
pkgs/html/test/differential_test.dart
pkgs/html/test/dom_parsing_test.dart
pkgs/html/test/mxss_test.dart
pkgs/html/test/noah_ark_clause_limit_test.dart

This check can be disabled by tagging the PR with skip-license-check.

Coverage ✔️

File	Coverage
pkgs/markdown/lib/src/inline_syntaxes/autolink_extension_syntax.dart	💚 100 %

This check for test coverage is informational (issues shown here will not fail the PR).

This check can be disabled by tagging the PR with skip-coverage-check.

gemini-code-assist

Code Review

This pull request updates the markdown parser to recognize extended email autolinks at positions where URL autolinks are not allowed to start. It introduces a separate _emailOnly regular expression and refactors tryMatch and onMatch in AutolinkExtensionSyntax to handle this logic, along with adding corresponding unit tests. The feedback suggests enforcing RFC-compliant length limits for email addresses (such as 64 characters for the local part and 63 characters for domain labels) to avoid generating links for non-RFC-compliant email addresses.

gemini-code-assist · 2026-11-04T11:45:10Z

+  static final _emailOnly = RegExp(
+    _emailPattern,
+    multiLine: true,
+    caseSensitive: false,
+  );


When parsing or validating email addresses for autolinks, we should enforce RFC-compliant length limits (such as 64 characters for the local part and 63 characters for domain labels) to avoid generating links for non-RFC-compliant email addresses.

// Ensure the email pattern or validation logic enforces RFC-compliant length limits // (e.g., 64 characters for the local part and 63 characters for domain labels).

References

When parsing or validating email addresses (e.g., for autolinks), enforce RFC-compliant length limits (such as 64 characters for the local part and 63 characters for domain labels) to avoid generating links for non-RFC-compliant email addresses.

nice improvements I'm not sure I care...

In `AutolinkExtensionSyntax.tryMatch`, check `_validPrecedingChars` before running the combined URL+email `pattern`, falling back to `_emailOnly` when a URL autolink cannot start at `startMatchPos`. ---- `AutolinkExtensionSyntax` implements GFM extended autolinks by combining `_linkPattern` (URL autolinks) and `_emailPattern` (email autolinks) into a single `pattern = RegExp('($_linkPattern)|($_emailPattern)')`. Previously, `tryMatch` ran the full `pattern.matchAsPrefix(parser.source, startMatchPos)` at every candidate position and only checked whether a URL match was preceded by a valid boundary character (`\n`, `' '`, `'*'`, `'_'`, `'~'`, `'('`, `'>'`) *after* `pattern.matchAsPrefix` succeeded. When a URL prefix like `www.` or `http://` appeared immediately after an invalid preceding character (such as `/www.a.b` repeated or `awww.example.com`), `tryMatch` still matched `_linkPattern` to the end of the line via `[^\s<]*[^\s<?!.,:*_~]` at every candidate position only to reject it afterward, taking O(n^2) time. 1. Before matching, `tryMatch` checks in O(1) time whether `startMatchPos == 0` or `parser.charAt(startMatchPos - 1)` is in `_validPrecedingChars`. 2. When `validLinkStart` is `false`, `tryMatch` runs `_emailOnly.matchAsPrefix` (`RegExp(_emailPattern, multiLine: true, caseSensitive: false)`), skipping `_linkPattern`. In `tryMatch` and `onMatch`, an email match is identified by `!validLinkStart || startMatch[2] != null` and `match.pattern == _emailOnly || match[2] != null`.

Revisions updated by `dart tools/rev_sdk_deps.dart`. core (https://github.com/dart-lang/core/compare/24e09c4..36f57a9): 36f57a99 Tue Nov 3 14:26:17 2026 +0100 Sigurd Meldgaard [os_detect] Remove bin/os_detect.dart (dart-lang/core#1015) 86bacfca Tue Nov 3 05:15:19 2026 -0500 Justin White [characters] Fix RangeError on an unpaired tail surrogate at range start (dart-lang/core#1033) dartdoc (https://github.com/dart-lang/dartdoc/compare/db94437..2f6847b): 2f6847bd Thu Oct 29 11:47:04 2026 +0200 Sergey G. Grekhov Add tests for invalid doc comments placement (dart-lang/dartdoc#4301) 17f2f0a3 Thu Oct 29 10:16:36 2026 +0100 Sarah Zakarias Compare base elements and unify properties in doc-reference-target-differs (dart-lang/dartdoc#4307) dartdoc is held back at 2f6847b, before dart-lang/dartdoc#4312, because its mock SDK version changes conflict in the google3 3-way merge with the hotfix in cl/1005963642. ecosystem (https://github.com/dart-lang/ecosystem/compare/f8faabf..54e1673): 54e1673 Wed Nov 4 09:46:54 2026 +0100 Sigurd Meldgaard fix(firehose): resolve dartExecutable via package:cli_util (dart-lang/ecosystem#469) d754065 Tue Nov 3 10:09:45 2026 -0800 Kevin Moore refactor(corpus): use path.join and seal closed type hierarchies (dart-lang/ecosystem#476) http (https://github.com/dart-lang/http/compare/8c0d66a..1f869d0): 1f869d0 Tue Nov 3 15:51:52 2026 -0800 dependabot[bot] chore(deps): bump the github-actions group with 8 updates (dart-lang/http#2052) 6d7f402 Tue Nov 3 14:12:04 2026 -0800 Brian Quinlan feat(cupertino_http): support custom trust eval (dart-lang/http#2038) 73f8c36 Tue Nov 3 10:15:16 2026 -0800 Brian Quinlan chore(cupertino_http): ready 3.1.1 release (dart-lang/http#2056) native (https://github.com/dart-lang/native/compare/b442038..1838637): 183863758 Wed Nov 4 09:01:27 2026 -0300 Daco Harkes [hooks_runner] Add `PKG_CONFIG_PATH` to environment variables allowlist (dart-lang/native#3779) c9e8118d4 Wed Nov 4 08:16:20 2026 +1100 Liam Appelbe [jni] Fix release mode segfault (dart-lang/native#3777) 5999cf7e4 Wed Nov 4 08:16:16 2026 +1100 Liam Appelbe [objective_c] Prepare to publish (dart-lang/native#3778) d294d9942 Tue Nov 3 15:15:49 2026 +0100 Michael Goderbauer [hooks_runner] Write recorded_uses.json under directory lock in link() (dart-lang/native#3770) 33aa5ef04 Tue Nov 3 11:42:38 2026 +1100 Liam Appelbe [objective_c] Cheaper and safer object/block validity checks (dart-lang/native#3776) protobuf (https://github.com/dart-lang/protobuf/compare/1d52301..19191c8): 19191c8 Wed Nov 4 17:14:33 2026 +0100 Sigurd Meldgaard Use dart.tool.dart2wasm in json.dart so DDC uses json_web.dart (google/protobuf.dart#1108) tools (https://github.com/dart-lang/tools/compare/1579f8d..a342744): a3427446f Wed Nov 4 15:11:35 2026 +0100 Jonas Finnemann Jensen Update CODEOWNERS for pkgs/markdown (dart-lang/tools#2795) 08c9afdc0 Wed Nov 4 14:40:44 2026 +0100 Jonas Finnemann Jensen [markdown] Check URL boundary before matching in AutolinkExtensionSyntax (dart-lang/tools#2786) 0fc5edcae Wed Nov 4 14:35:48 2026 +0100 Jonas Finnemann Jensen [markdown] Skip unclosed inline HTML tags before matching RegExp (dart-lang/tools#2788) b1f6f9956 Wed Nov 4 14:31:55 2026 +0100 Jonas Finnemann Jensen [markdown] Defer shortcut reference link label extraction in LinkSyntax.close (dart-lang/tools#2785) ab135e072 Wed Nov 4 14:30:37 2026 +0100 Jonas Finnemann Jensen [markdown] Avoid quadratic trailing-paren scan in AutolinkExtensionSyntax (dart-lang/tools#2787) f329bf3ea Wed Nov 4 17:09:34 2026 +0530 Ananya Kaul [code_builder] Separate chained cascades after nullable casts (dart-lang/tools#2704) 0a57e3446 Wed Nov 4 05:28:40 2026 +0530 Aman Maurya fix(coverage): allow empty coverage files from skipped test suites (`#2667`) (dart-lang/tools#2668) e95958f6a Tue Nov 3 21:53:57 2026 +0000 Keerti Parthasarathy [unified_analytics] Add root_tool and leaf_tool to every event; key consent on root_tool (dart-lang/tools#2784) 5da06a508 Tue Nov 3 13:11:04 2026 +0100 Jonas Finnemann Jensen [markdown] Reject unescaped '(' in parenthesized inline link titles (dart-lang/tools#2770) f3a5c9277 Tue Nov 3 13:09:32 2026 +0100 Jonas Finnemann Jensen [markdown] Cap parenthesis nesting in bare inline link destinations (dart-lang/tools#2769) 820ce5fb7 Tue Nov 3 13:04:35 2026 +0100 Jonas Finnemann Jensen [markdown] Reject unescaped '(' in parenthesized link reference titles (dart-lang/tools#2771) 775c5d080 Tue Nov 3 13:03:43 2026 +0100 Jonas Finnemann Jensen [markdown] Require balanced parentheses before bare inline link titles (dart-lang/tools#2768) 5ebd52bc5 Tue Nov 3 13:03:08 2026 +0100 Jonas Finnemann Jensen [markdown] Reject unescaped '<' in bracketed inline link destinations (dart-lang/tools#2767) feb7ea928 Tue Nov 3 13:02:15 2026 +0100 Jonas Finnemann Jensen [markdown] Fix 999-character limit in LinkParser.parseLabel (dart-lang/tools#2766) 31888a5da Tue Nov 3 13:01:43 2026 +0100 Jonas Finnemann Jensen [markdown] Enforce 999-character limit in _parseReferenceLinkLabel (dart-lang/tools#2765) e016c5d70 Tue Nov 3 09:26:32 2026 +0100 dart-ecosystem-bot[bot] [boring] Pin the prebuilt binaries of boring-binaries-20261101-f869fdca423c (dart-lang/tools#2778) 8c7935573 Mon Nov 2 10:15:24 2026 -0800 Kevin Moore [html] Move WPT selector fixtures to third_party/wpt-selectors (dart-lang/tools#2772) web (https://github.com/dart-lang/web/compare/45166fd..f388bf5): f388bf5 Sun Nov 1 06:57:22 2026 +0000 dependabot[bot] Bump the github-actions group with 4 updates (dart-lang/web#611) 658ce2f Sat Oct 31 12:47:20 2026 +0100 Moritz Migrate to ecosystem health publish check and setup-dart publish workflow (dart-lang/web#610) Change-Id: Ifcae02c4712b4b27a5a8ab1c57d8dcf13a6700cf Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/574281 Reviewed-by: Brian Quinlan <[email protected]> Commit-Queue: Nate Bosch <[email protected]>

github-actions Bot added the package:markdown label Nov 4, 2026

gemini-code-assist Bot reviewed Nov 4, 2026

View reviewed changes

jonasfj force-pushed the markdown_autolink_boundary_first branch from 247d472 to 2f4a283 Compare November 4, 2026 13:33

jonasfj requested a review from sigurdm November 4, 2026 13:34

jonasfj marked this pull request as ready for review November 4, 2026 13:34

jonasfj requested a review from srawlins as a code owner November 4, 2026 13:34

srawlins approved these changes Nov 4, 2026

View reviewed changes

jonasfj merged commit 08c9afd into main Nov 4, 2026
25 checks passed

jonasfj deleted the markdown_autolink_boundary_first branch November 4, 2026 13:40

Navigation Menu

Repository navigation

[markdown] Check URL boundary before matching in AutolinkExtensionSyntax - #2786

[markdown] Check URL boundary before matching in AutolinkExtensionSyntax#2786
jonasfj merged 1 commit into
mainfrom
markdown_autolink_boundary_first

jonasfj commented Nov 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 4, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Nov 4, 2026

Uh oh!

jonasfj Nov 4, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jonasfj commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why this change is necessary

How this change works

Behavior change

Differential testing

Uh oh!

github-actions Bot commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Health

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Nov 4, 2026

Choose a reason for hiding this comment

Uh oh!

jonasfj Nov 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jonasfj commented Nov 4, 2026 •

edited

Loading

github-actions Bot commented Nov 4, 2026 •

edited

Loading