Merge commit from fork

fix: resolve O(n^2) DoS in parse_link_text (CWE-400)

Author: lepture

src/mistune/helpers.py

@@ -115,7 +115,7 @@ def parse_link_text(src: str, pos: int) -> Union[Tuple[str, int], Tuple[None, No
     while pos < len(src):
         m = _INLINE_SQUARE_BRACKET_RE.search(src, pos)
         if not m:
-            pos = len(src)  # ← CHANGE 1: record we scanned to end
+            pos = len(src)  # FIX: record we scanned to end
             break
 
         pos = m.end()
@@ -129,9 +129,9 @@ def parse_link_text(src: str, pos: int) -> Union[Tuple[str, int], Tuple[None, No
             level += 1
 
     if found:
-        text = src[start_pos : pos - 1]
+        text = src[start_pos: pos - 1]
         return text, pos
-    return None, pos  # ← CHANGE 2: return pos instead of None
+    return None, pos  # FIX: return pos instead of None
 
 
 def parse_link_label(src: str, start_pos: int) -> Union[Tuple[str, int], Tuple[None, None]]:

src/mistune/inline_parser.py

@@ -126,13 +126,17 @@ def parse_link(self, m: Match[str], state: InlineState) -> Optional[int]:
         text = None
         label, end_pos = parse_link_label(state.src, pos)
         if label is None:
+            # FIX: high-water mark — if we already scanned this region
+            # and found no closing ']', skip immediately without rescanning
+            no_close = getattr(state, '_no_close_bracket_before', 0)
+            if pos <= no_close:
+                state.append_token({"type": "text", "raw": marker})
+                return pos
             text, end_pos = parse_link_text(state.src, pos)
             if text is None:
-                # ← CHANGE: emit skipped content as literal text
-                # so nothing is dropped, then jump ahead to end_pos
-                skipped = state.src[m.start():end_pos]
-                state.append_token({"type": "text", "raw": skipped})
-                return end_pos
+                if end_pos is not None and end_pos > no_close:
+                    state._no_close_bracket_before = end_pos
+                return None
 
         assert end_pos is not None