CVE-2023-26303 (published 2023-02-23T00:15Z)

Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.\n

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/executablebooks/markdown-it-py
commit_details: repo_url: https://github.com/executablebooks/markdown-it-py
author: Chris Sewell
author_date: 2023-02-22 05:56:39+01:00
msg: 🐛 FIX: CVE-2023-26303 (#246)

Fix unnecessary asserts, leading to crashes
repository: repo_url: https://github.com/executablebooks/markdown-it-py
repo_name: executablebooks/markdown-it-py
description: Markdown parser, done right. 100% CommonMark support, extensions, syntax plugins & high speed. Now in Python!
repo_language: Python
owner: executablebooks
file_changes: filename: renderer.py
change_type: ModificationType.MODIFY
diff: @@ -83,8 +83,8 @@ class RendererHTML(RendererProtocol):
 
         for i, token in enumerate(tokens):
             if token.type == "inline":
-                assert token.children is not None
-                result += self.renderInline(token.children, options, env)
+                if token.children:
+                    result += self.renderInline(token.children, options, env)
             elif token.type in self.rules:
                 result += self.rules[token.type](tokens, i, options, env)
             else:
@@ -206,8 +206,8 @@ class RendererHTML(RendererProtocol):
             if token.type == "text":
                 result += token.content
             elif token.type == "image":
-                assert token.children is not None
-                result += self.renderInlineAsText(token.children, options, env)
+                if token.children:
+                    result += self.renderInlineAsText(token.children, options, env)
             elif token.type == "softbreak":
                 result += "\n"
 
@@ -305,14 +305,10 @@ class RendererHTML(RendererProtocol):
 
         # "alt" attr MUST be set, even if empty. Because it's mandatory and
         # should be placed on proper position for tests.
-
-        assert (
-            token.attrs and "alt" in token.attrs
-        ), '"image" token\'s attrs must contain `alt`'
-
-        # Replace content with actual value
-
-        token.attrSet("alt", self.renderInlineAsText(token.children, options, env))
+        if token.children:
+            token.attrSet("alt", self.renderInlineAsText(token.children, options, env))
+        else:
+            token.attrSet("alt", "")
 
         return self.renderToken(tokens, idx, options, env)
 

programming_language: Python
filename: replacements.py
change_type: ModificationType.MODIFY
diff: @@ -116,7 +116,8 @@ def replace(state: StateCore) -> None:
     for token in state.tokens:
         if token.type != "inline":
             continue
-        assert token.children is not None
+        if token.children is None:
+            continue
 
         if SCOPED_ABBR_RE.search(token.content):
             replace_scoped(token.children)

programming_language: Python
filename: smartquotes.py
change_type: ModificationType.MODIFY
diff: @@ -197,5 +197,5 @@ def smartquotes(state: StateCore) -> None:
     for token in state.tokens:
         if token.type != "inline" or not QUOTE_RE.search(token.content):
             continue
-        assert token.children is not None
-        process_inlines(token.children, state)
+        if token.children is not None:
+            process_inlines(token.children, state)

programming_language: Python
filename: issue-fixes.md
change_type: ModificationType.MODIFY
diff: @@ -36,3 +36,12 @@
 .
 <p>💬</p>
 .
+
+Fix CVE-2023-26303
+.
+![![]()
+]([)
+.
+<p><img src="%5B" alt="
+" /></p>
+.

programming_language: Markdown
filename: test_fixtures.py
change_type: ModificationType.MODIFY
diff: @@ -111,4 +111,5 @@ def test_strikethrough(line, title, input, expected):
 def test_issue_fixes(line, title, input, expected):
     md = MarkdownIt()
     text = md.render(input)
+    print(text)
     assert text.rstrip() == expected.rstrip()

programming_language: Python