Blair Hamilton 9015afb0f1
fix: update vulnerable dependencies to address security issues (#598)
Updates two dependencies with known security vulnerabilities:

1. github.com/gomarkdown/markdown
   - Updated from v0.0.0-20191123064959-2c17d62f5098 (Nov 2019)
   - Updated to v0.0.0-20250810172220-2e2c11897d1a (Aug 2025)   - Fixes 2 HIGH severity vulnerabilities reported by OSV scanner2. github.com/disintegration/imaging   - Updated from v1.6.2   - Updated to v1.6.3-0.20201218193011-d40f48ce0f09 (master branch)
   - Fixes 1 MEDIUM severity vulnerability
   - Note: Using master branch as no new tagged release available since 2019

Both packages are indirect dependencies pulled in through
github.com/MichaelMure/go-term-markdown.

Changes:
- go get github.com/gomarkdown/markdown@latest
- go get github.com/disintegration/imaging@master
- go mod tidy
- go mod vendor

All tests pass and build successful.
2025-12-07 14:00:12 -08:00

71 lines
1.3 KiB
Go

package parser
import (
"bytes"
)
// caption checks for a caption, it returns the caption data and a potential "headingID".
func (p *Parser) caption(data, caption []byte) ([]byte, string, int) {
if !bytes.HasPrefix(data, caption) {
return nil, "", 0
}
j := len(caption)
data = data[j:]
end := LinesUntilEmpty(data)
data = data[:end]
id, start := captionID(data)
if id != "" {
return data[:start], id, end + j
}
return data, "", end + j
}
// LinesUntilEmpty scans lines up to the first empty line.
func LinesUntilEmpty(data []byte) int {
line, i := 0, 0
for line < len(data) {
i++
// find the end of this line
for i < len(data) && data[i-1] != '\n' {
i++
}
if IsEmpty(data[line:i]) == 0 {
line = i
continue
}
break
}
return i
}
// captionID checks if the caption *ends* in {#....}. If so the text after {# is taken to be
// the ID/anchor of the entire figure block.
func captionID(data []byte) (string, int) {
end := len(data)
j, k := 0, 0
// find start/end of heading id
for j = 0; j < end-1 && (data[j] != '{' || data[j+1] != '#'); j++ {
}
for k = j + 1; k < end && data[k] != '}'; k++ {
}
// remains must be whitespace.
for l := k + 1; l < end; l++ {
if !IsSpace(data[l]) {
return "", 0
}
}
if j > 0 && k > 0 && j+2 < k {
return string(data[j+2 : k]), j
}
return "", 0
}