Bump to 0.23.0

Fix CodeInline to plain text incorrect escape

.github/workflows/ci.yml

@@ -20,16 +20,16 @@ jobs:
     - name: Checkout
       uses: actions/checkout@v1
 
-    - name: Install .NET Core
+    - name: Install .NET 5.0
       uses: actions/setup-dotnet@v1
       with:
-        dotnet-version: '3.1.x'
+        dotnet-version: '5.0.x'
 
     - name: Build (Release)
       run: dotnet build src -c Release
-
+      
     - name: SpecFileGen
-      run: dotnet src/SpecFileGen/bin/Release/netcoreapp3.1/SpecFileGen.dll
+      run: dotnet src/SpecFileGen/bin/Release/net5.0/SpecFileGen.dll
 
     - name: Test (Release)
       run: dotnet test src -c Release
@@ -38,14 +38,14 @@ jobs:
       run: dotnet test src -c Debug
 
     - name: Coverlet
-      run: dotnet test src -c Release -f netcoreapp3.1 /p:Include=\"[${{env.PROJECT_NAME}}]*\" /p:CollectCoverage=true /p:CoverletOutputFormat=lcov
+      run: dotnet test src -c Release -f net5.0 /p:Include=\"[${{env.PROJECT_NAME}}]*\" /p:CollectCoverage=true /p:CoverletOutputFormat=lcov
 
     - name: Coveralls Upload
       uses: coverallsapp/github-action@v1.0.1
       if: github.event_name == 'push' && github.ref == 'refs/heads/master'
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
-        path-to-lcov: src/${{env.PROJECT_NAME}}.Tests/coverage.netcoreapp3.1.info
+        path-to-lcov: src/${{env.PROJECT_NAME}}.Tests/coverage.info
 
     - name: Pack
       run: dotnet pack src -c Release

changelog.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.23.0 (16 Jan 2021)
+- Add depth limits to avoid pathological-case parsing times/StackOverflows (#500)
+- Breaking change: rename AutolineInlineParser to AutolinkInlineParser
+
 ## 0.22.1 (2 Dec 2020)
 - Update logo for NuGet package
 

src/Markdig.Benchmarks/Markdig.Benchmarks.csproj

@@ -36,12 +36,12 @@
     </Content>
   </ItemGroup>
   <ItemGroup>
-    <PackageReference Include="BenchmarkDotNet" Version="0.10.6" />
-    <PackageReference Include="BenchmarkDotNet.Diagnostics.Windows" Version="0.10.6" />
+    <PackageReference Include="BenchmarkDotNet" Version="0.12.1" />
+    <PackageReference Include="BenchmarkDotNet.Diagnostics.Windows" Version="0.12.1" />
     <PackageReference Include="CommonMark.NET" Version="0.15.1" />
-    <PackageReference Include="MarkdownSharp" Version="1.13.0.0" />
-    <PackageReference Include="Microsoft.Diagnostics.Runtime" Version="0.8.31-beta" />
-    <PackageReference Include="Microsoft.Diagnostics.Tracing.TraceEvent" Version="1.0.41.0" />
+    <PackageReference Include="MarkdownSharp" Version="2.0.5" />
+    <PackageReference Include="Microsoft.Diagnostics.Runtime" Version="2.0.161401" />
+    <PackageReference Include="Microsoft.Diagnostics.Tracing.TraceEvent" Version="2.0.62" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\Markdig\Markdig.csproj" />

src/Markdig.Tests/Markdig.Tests.csproj

@@ -1,7 +1,7 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFrameworks>netcoreapp3.1</TargetFrameworks>
+    <TargetFramework>net5.0</TargetFramework>
     <OutputType>Exe</OutputType>
     <IsPackable>false</IsPackable>
     <StartupObject>Markdig.Tests.Program</StartupObject>
@@ -12,7 +12,7 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="16.7.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="16.8.3" />
     <PackageReference Include="NUnit" Version="3.12.0" />
     <PackageReference Include="NUnit3TestAdapter" Version="3.17.0" />
   </ItemGroup>

src/Markdig.Tests/MiscTests.cs

@@ -62,6 +62,29 @@ namespace Markdig.Tests
             }
         }
 
+        [Theory]
+        [TestCase('[', 9 * 1024, true, false)]
+        [TestCase('[', 11 * 1024, true, true)]
+        [TestCase('[', 100, false, false)]
+        [TestCase('[', 150, false, true)]
+        [TestCase('>', 100, true, false)]
+        [TestCase('>', 150, true, true)]
+        public void GuardsAgainstHighlyNestedNodes(char c, int count, bool parseOnly, bool shouldThrow)
+        {
+            var markdown = new string(c, count);
+            TestDelegate test = parseOnly ? () => Markdown.Parse(markdown) : () => Markdown.ToHtml(markdown);
+
+            if (shouldThrow)
+            {
+                Exception e = Assert.Throws<ArgumentException>(test);
+                Assert.True(e.Message.Contains("depth limit"));
+            }
+            else
+            {
+                test();
+            }
+        }
+
         [Test]
         public void IsIssue356Corrected()
         {

src/Markdig.Tests/TestPlainText.cs

@@ -21,6 +21,7 @@ namespace Markdig.Tests
         [TestCase(/* markdownText: */ "- foo\n- bar\n- baz", /* expected: */ "foo\nbar\nbaz\n")]
         [TestCase(/* markdownText: */ "- foo<baz", /* expected: */ "foo<baz\n")]
         [TestCase(/* markdownText: */ "- foo&lt;baz", /* expected: */ "foo<baz\n")]
+        [TestCase(/* markdownText: */ "## foo `bar::baz >`", /* expected: */ "foo bar::baz >\n")]
         public void TestPlainEnsureNewLine(string markdownText, string expected)
         {            
             var actual = Markdown.ToPlainText(markdownText);

src/Markdig.WebApp/Markdig.WebApp.csproj

@@ -1,42 +1,22 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>netcoreapp2.0</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <PreserveCompilationContext>true</PreserveCompilationContext>
     <AssemblyName>Markdig.WebApp</AssemblyName>
     <OutputType>Exe</OutputType>
     <PackageId>Markdig.WebApp</PackageId>
-    <RuntimeFrameworkVersion>2.0.0</RuntimeFrameworkVersion>
     <ApplicationInsightsResourceId>/subscriptions/b6745039-70e7-4641-994b-5457cb220e2a/resourcegroups/Default-ApplicationInsights-EastUS/providers/microsoft.insights/components/Markdig.WebApp</ApplicationInsightsResourceId>
     <ApplicationInsightsAnnotationResourceId>/subscriptions/b6745039-70e7-4641-994b-5457cb220e2a/resourcegroups/Default-ApplicationInsights-EastUS/providers/microsoft.insights/components/Markdig.WebApp</ApplicationInsightsAnnotationResourceId>
     <IsPackable>false</IsPackable>
+    <UserSecretsId>683145f2-53a7-4938-bd96-35e60ac55d95</UserSecretsId>
   </PropertyGroup>
 
   <ItemGroup>
-    <None Update="Views">
-      <CopyToPublishDirectory>PreserveNewest</CopyToPublishDirectory>
-    </None>
+    <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.16.0" />
   </ItemGroup>
 
   <ItemGroup>
     <ProjectReference Include="..\Markdig\Markdig.csproj" />
   </ItemGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.12.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="2.2.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Server.IISIntegration" Version="2.2.1" />
-    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel" Version="2.2.0" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="3.1.1" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.FileExtensions" Version="3.1.1" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="3.1.1" />
-    <PackageReference Include="Microsoft.Extensions.Logging" Version="3.1.1" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="3.1.1" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="3.1.1" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <WCFMetadata Include="Connected Services" />
-  </ItemGroup>
-
 </Project>

src/Markdig.WebApp/Program.cs

@@ -1,6 +1,7 @@
 using System.IO;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.Hosting;
 
 namespace Markdig.WebApp
 {
@@ -8,14 +9,14 @@ namespace Markdig.WebApp
     {
         public static void Main(string[] args)
         {
-            var host = new WebHostBuilder()
-                .UseKestrel()
-                .UseContentRoot(Directory.GetCurrentDirectory())
-                .UseIISIntegration()
-                .UseStartup<Startup>()
-                .Build();
-
-            host.Run();
+            CreateHostBuilder(args).Build().Run();
         }
+
+        public static IHostBuilder CreateHostBuilder(string[] args) =>
+            Host.CreateDefaultBuilder(args)
+                .ConfigureWebHostDefaults(webBuilder =>
+                {
+                    webBuilder.UseStartup<Startup>();
+                });
     }
 }

src/Markdig.WebApp/Properties/PublishProfiles/markdig - Web Deploy-publish.ps1

@@ -1,111 +0,0 @@
-# Copyright (c) Microsoft Open Technologies, Inc. All rights reserved.
-# Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
-
-[cmdletbinding(SupportsShouldProcess=$true)]
-param($publishProperties=@{}, $packOutput, $pubProfilePath, $nugetUrl)
-
-# to learn more about this file visit https://go.microsoft.com/fwlink/?LinkId=524327
-$publishModuleVersion = '1.1.0'
-
-function Get-PublishModulePath{
-    [cmdletbinding()]
-    param()
-    process{
-        $keysToCheck = @('hklm:\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\{0}',
-                         'hklm:\SOFTWARE\Microsoft\VisualStudio\{0}',
-                         'hklm:\SOFTWARE\Wow6432Node\Microsoft\VWDExpress\{0}',
-                         'hklm:\SOFTWARE\Microsoft\VWDExpress\{0}'
-                         )
-        $versions = @('14.0', '15.0')
-
-        [string]$publishModulePath=$null
-        :outer foreach($keyToCheck in $keysToCheck){
-            foreach($version in $versions){
-                if(Test-Path ($keyToCheck -f $version) ){
-                    $vsInstallPath = (Get-itemproperty ($keyToCheck -f $version) -Name InstallDir -ErrorAction SilentlyContinue | select -ExpandProperty InstallDir -ErrorAction SilentlyContinue)
-                    
-                    if($vsInstallPath){
-                        $installedPublishModulePath = "{0}Extensions\Microsoft\Web Tools\Publish\Scripts\{1}\" -f $vsInstallPath, $publishModuleVersion
-                        if(!(Test-Path $installedPublishModulePath)){
-                            $vsInstallPath = $vsInstallPath + 'VWDExpress'
-                            $installedPublishModulePath = "{0}Extensions\Microsoft\Web Tools\Publish\Scripts\{1}\" -f  $vsInstallPath, $publishModuleVersion
-                        }
-                        if(Test-Path $installedPublishModulePath){
-                            $publishModulePath = $installedPublishModulePath
-                            break outer;
-                        }
-                    }
-                }
-            }
-        }
-
-        $publishModulePath
-    }
-}
-
-$publishModulePath = Get-PublishModulePath
-
-$defaultPublishSettings = New-Object psobject -Property @{
-    LocalInstallDir = $publishModulePath
-}
-
-function Enable-PackageDownloader{
-    [cmdletbinding()]
-    param(
-        $toolsDir = "$env:LOCALAPPDATA\Microsoft\Web Tools\Publish\package-downloader-$publishModuleVersion\",
-        $pkgDownloaderDownloadUrl = 'https://go.microsoft.com/fwlink/?LinkId=524325') # package-downloader.psm1
-    process{
-        if(get-module package-downloader){
-            remove-module package-downloader | Out-Null
-        }
-
-        if(!(get-module package-downloader)){
-            if(!(Test-Path $toolsDir)){ New-Item -Path $toolsDir -ItemType Directory -WhatIf:$false }
-
-            $expectedPath = (Join-Path ($toolsDir) 'package-downloader.psm1')
-            if(!(Test-Path $expectedPath)){
-                'Downloading [{0}] to [{1}]' -f $pkgDownloaderDownloadUrl,$expectedPath | Write-Verbose
-                (New-Object System.Net.WebClient).DownloadFile($pkgDownloaderDownloadUrl, $expectedPath)
-            }
-        
-            if(!$expectedPath){throw ('Unable to download package-downloader.psm1')}
-
-            'importing module [{0}]' -f $expectedPath | Write-Output
-            Import-Module $expectedPath -DisableNameChecking -Force
-        }
-    }
-}
-
-function Enable-PublishModule{
-    [cmdletbinding()]
-    param()
-    process{
-        if(get-module publish-module){
-            remove-module publish-module | Out-Null
-        }
-
-        if(!(get-module publish-module)){
-            $localpublishmodulepath = Join-Path $defaultPublishSettings.LocalInstallDir 'publish-module.psm1'
-            if(Test-Path $localpublishmodulepath){
-                'importing module [publish-module="{0}"] from local install dir' -f $localpublishmodulepath | Write-Verbose
-                Import-Module $localpublishmodulepath -DisableNameChecking -Force
-                $true
-            }
-        }
-    }
-}
-
-try{
-
-    if (!(Enable-PublishModule)){
-        Enable-PackageDownloader
-        Enable-NuGetModule -name 'publish-module' -version $publishModuleVersion -nugetUrl $nugetUrl
-    }
-
-    'Calling Publish-AspNet' | Write-Verbose
-    # call Publish-AspNet to perform the publish operation
-    Publish-AspNet -publishProperties $publishProperties -packOutput $packOutput -pubProfilePath $pubProfilePath
-}
-catch{
-    "An error occurred during publish.`n{0}" -f $_.Exception.Message | Write-Error
-}

src/Markdig.WebApp/Properties/launchSettings.json

@@ -1,28 +1,9 @@
 {
-  "iisSettings": {
-    "windowsAuthentication": false,
-    "anonymousAuthentication": true,
-    "iisExpress": {
-      "applicationUrl": "http://localhost:65396/",
-      "sslPort": 0
-    }
-  },
   "profiles": {
-    "IIS Express": {
-      "commandName": "IISExpress",
-      "launchBrowser": true,
-      "launchUrl": "api/values",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
-    },
     "Markdig.WebApp": {
       "commandName": "Project",
       "launchBrowser": true,
-      "launchUrl": "http://localhost:5000/api/to_html?text=yes",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
+      "launchUrl": "api/to_html?text=test"
     }
   }
 }

src/Markdig.WebApp/Startup.cs

@@ -30,19 +30,30 @@ namespace Markdig.WebApp
         // This method gets called by the runtime. Use this method to add services to the container
         public void ConfigureServices(IServiceCollection services)
         {
+            services.AddControllers();
+            
             // Add framework services.
             services.AddApplicationInsightsTelemetry(Configuration);
-
-            services.AddMvc();
         }
 
         // This method gets called by the runtime. Use this method to configure the HTTP request pipeline
         public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
         {
-            //loggerFactory.AddConsole(Configuration.GetSection("Logging"));
-            //loggerFactory.AddDebug();
+            if (env.IsDevelopment())
+            {
+                app.UseDeveloperExceptionPage();
+            }
 
-            app.UseMvc();
+            app.UseHttpsRedirection();
+
+            app.UseRouting();
+
+            app.UseAuthorization();
+
+            app.UseEndpoints(endpoints =>
+            {
+                endpoints.MapControllers();
+            });
         }
     }
 }

src/Markdig.WebApp/appsettings.json

@@ -8,6 +8,7 @@
     }
   },
   "ApplicationInsights": {
-    "InstrumentationKey": "5d12f113-76b2-41fe-a35a-db454b104bf9"
+    "InstrumentationKey": "5d12f113-76b2-41fe-a35a-db454b104bf9",
+    "ConnectionString": "InstrumentationKey=c00ad051-d881-4dc3-b8c1-8718f1b1c0c6;IngestionEndpoint=https://westus2-0.in.applicationinsights.azure.com/"
   }
 }

src/Markdig.WebApp/web.config

@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<configuration>
-
-  <!--
-    Configure your application settings in appsettings.json. Learn more at http://go.microsoft.com/fwlink/?LinkId=786380
-  -->
-
-  <system.webServer>
-    <handlers>
-      <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModule" resourceType="Unspecified"/>
-    </handlers>
-    <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="false"/>
-  </system.webServer>
-</configuration>

src/Markdig/Helpers/ThrowHelper.cs

@@ -5,6 +5,7 @@
 using System;
 using System.Diagnostics;
 using System.Diagnostics.CodeAnalysis;
+using System.Runtime.CompilerServices;
 
 namespace Markdig.Helpers
 {
@@ -34,6 +35,28 @@ namespace Markdig.Helpers
 
         public static void InvalidOperationException(string message) => throw new InvalidOperationException(message);
 
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public static void CheckDepthLimit(int depth, bool useLargeLimit = false)
+        {
+            // Very conservative limit used to limit nesting in the final AST
+            // Used to avoid a StackOverflow in the recursive rendering process
+            const int DepthLimit = 128;
+
+            // Limit used for reducing the maximum execution time for pathological-case inputs
+            // Applies to:
+            // a) inputs that would fail depth checks in the future (for example "[[[[[..." or ">>>>>>...")
+            // b) very large pipe tables
+            const int LargeDepthLimit = 10 * 1024;
+
+            int limit = useLargeLimit ? LargeDepthLimit : DepthLimit;
+
+            if (depth > limit)
+                DepthLimitExceeded();
+
+            [MethodImpl(MethodImplOptions.NoInlining)]
+            static void DepthLimitExceeded() => throw new ArgumentException("Markdown elements in the input are too deeply nested - depth limit exceeded. Input is most likely not sensible or is a very large table.");
+        }
+
         public static void ThrowArgumentNullException(ExceptionArgument argument)
         {
             throw new ArgumentNullException(argument.ToString());

src/Markdig/Markdig.csproj

@@ -1,6 +1,12 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <PackageId>Markdig</PackageId>
   </PropertyGroup>
   <Import Project="Markdig.targets" />
+  <ItemGroup>
+    <None Remove="readme.md" />
+  </ItemGroup>
+  <ItemGroup>
+    <AdditionalFiles Include="readme.md" LunetApiDotNet="true"/>
+  </ItemGroup>
 </Project>

src/Markdig/Markdig.targets

@@ -4,7 +4,7 @@
     <Description>A fast, powerful, CommonMark compliant, extensible Markdown processor for .NET with 20+ builtin extensions (pipetables, footnotes, definition lists... etc.)</Description>
     <Copyright>Alexandre Mutel</Copyright>
     <NeutralLanguage>en-US</NeutralLanguage>
-    <VersionPrefix>0.22.1</VersionPrefix>
+    <VersionPrefix>0.23.0</VersionPrefix>
     <Authors>Alexandre Mutel</Authors>
     <TargetFrameworks>net452;netstandard2.0;netstandard2.1;netcoreapp2.1;netcoreapp3.1</TargetFrameworks>
     <PackageTags>Markdown CommonMark md html md2html</PackageTags>
@@ -13,7 +13,7 @@
     <PackageIcon>markdig.png</PackageIcon>
     <PackageProjectUrl>https://github.com/lunet-io/markdig</PackageProjectUrl>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
-    <LangVersion>8.0</LangVersion>
+    <LangVersion>9.0</LangVersion>
     <!--Add support for sourcelink-->
     <PublishRepositoryUrl>true</PublishRepositoryUrl>
     <IncludeSymbols>true</IncludeSymbols>

src/Markdig/MarkdownExtensions.cs

@@ -522,7 +522,7 @@ namespace Markdig
                 pipeline.BlockParsers.Remove(parser);
             }
 
-            var inlineParser = pipeline.InlineParsers.Find<AutolineInlineParser>();
+            var inlineParser = pipeline.InlineParsers.Find<AutolinkInlineParser>();
             if (inlineParser != null)
             {
                 inlineParser.EnableHtmlParsing = false;

src/Markdig/MarkdownPipelineBuilder.cs

@@ -44,7 +44,7 @@ namespace Markdig
                 new EscapeInlineParser(),
                 new EmphasisInlineParser(),
                 new CodeInlineParser(),
-                new AutolineInlineParser(),
+                new AutolinkInlineParser(),
                 new LineBreakInlineParser(),
             };
 

src/Markdig/Parsers/InlineProcessor.cs

@@ -307,7 +307,7 @@ namespace Markdig.Parsers
         private ContainerInline FindLastContainer()
         {
             var container = Block.Inline;
-            while (true)
+            for (int depth = 0; ; depth++)
             {
                 if (container.LastChild is ContainerInline nextContainer && !nextContainer.IsClosed)
                 {
@@ -315,10 +315,10 @@ namespace Markdig.Parsers
                 }
                 else
                 {
-                    break;
+                    ThrowHelper.CheckDepthLimit(depth, useLargeLimit: true);
+                    return container;
                 }
             }
-            return container;
         }
     }
 }

src/Markdig/Parsers/Inlines/AutolinkInlineParser.cs

@@ -12,12 +12,12 @@ namespace Markdig.Parsers.Inlines
     /// An inline parser for parsing <see cref="AutolinkInline"/>.
     /// </summary>
     /// <seealso cref="InlineParser" />
-    public class AutolineInlineParser : InlineParser
+    public class AutolinkInlineParser : InlineParser
     {
         /// <summary>
-        /// Initializes a new instance of the <see cref="AutolineInlineParser"/> class.
+        /// Initializes a new instance of the <see cref="AutolinkInlineParser"/> class.
         /// </summary>
-        public AutolineInlineParser()
+        public AutolinkInlineParser()
         {
             OpeningCharacters = new[] {'<'};
             EnableHtmlParsing = true;

src/Markdig/Parsers/MarkdownParser.cs

@@ -191,6 +191,7 @@ namespace Markdig.Parsers
                         newItem.Container = (ContainerBlock)block;
                         block.OnProcessInlinesBegin(inlineProcessor);
                         newItem.Index = 0;
+                        ThrowHelper.CheckDepthLimit(blocks.Count);
                         blocks.Push(newItem);
                         goto process_new_block;
                     }

src/Markdig/Renderers/Html/Inlines/CodeInlineRenderer.cs

@@ -18,7 +18,14 @@ namespace Markdig.Renderers.Html.Inlines
             {
                 renderer.Write("<code").WriteAttributes(obj).Write(">");
             }
-            renderer.WriteEscape(obj.Content);
+            if (renderer.EnableHtmlEscape)
+            {
+                renderer.WriteEscape(obj.Content);
+            }
+            else
+            {
+                renderer.Write(obj.Content);
+            }
             if (renderer.EnableHtmlForInline)
             {
                 renderer.Write("</code>");

src/Markdig/Renderers/RendererBase.cs

@@ -4,6 +4,7 @@
 
 using System;
 using System.Collections.Generic;
+using Markdig.Helpers;
 using Markdig.Syntax;
 using Markdig.Syntax.Inlines;
 
@@ -18,6 +19,7 @@ namespace Markdig.Renderers
         private readonly Dictionary<Type, IMarkdownObjectRenderer> renderersPerType;
         private IMarkdownObjectRenderer previousRenderer;
         private Type previousObjectType;
+        internal int childrenDepth = 0;
 
         /// <summary>
         /// Initializes a new instance of the <see cref="RendererBase"/> class.
@@ -57,6 +59,8 @@ namespace Markdig.Renderers
                 return;
             }
 
+            ThrowHelper.CheckDepthLimit(childrenDepth++);
+
             bool saveIsFirstInContainer = IsFirstInContainer;
             bool saveIsLastInContainer = IsLastInContainer;
 
@@ -70,6 +74,8 @@ namespace Markdig.Renderers
 
             IsFirstInContainer = saveIsFirstInContainer;
             IsLastInContainer = saveIsLastInContainer;
+
+            childrenDepth--;
         }
 
         /// <summary>
@@ -83,6 +89,8 @@ namespace Markdig.Renderers
                 return;
             }
 
+            ThrowHelper.CheckDepthLimit(childrenDepth++);
+
             bool saveIsFirstInContainer = IsFirstInContainer;
             bool saveIsLastInContainer = IsLastInContainer;
 
@@ -101,6 +109,8 @@ namespace Markdig.Renderers
 
             IsFirstInContainer = saveIsFirstInContainer;
             IsLastInContainer = saveIsLastInContainer;
+
+            childrenDepth--;
         }
 
         /// <summary>

src/Markdig/Renderers/TextRendererBase.cs

@@ -101,6 +101,7 @@ namespace Markdig.Renderers
                 ThrowHelper.InvalidOperationException("Cannot reset this TextWriter instance");
             }
 
+            childrenDepth = 0;
             previousWasLine = true;
             indents.Clear();
         }

src/Markdig/Syntax/Block.cs

@@ -2,6 +2,7 @@
 // This file is licensed under the BSD-Clause 2 license. 
 // See the license.txt file in the project root for more information.
 
+using Markdig.Helpers;
 using Markdig.Parsers;
 
 namespace Markdig.Syntax
@@ -79,6 +80,7 @@ namespace Markdig.Syntax
         public void UpdateSpanEnd(int spanEnd)
         {
             // Update parent spans
+            int depth = 0;
             var parent = this;
             while (parent != null)
             {
@@ -87,7 +89,9 @@ namespace Markdig.Syntax
                     parent.Span.End = spanEnd;
                 }
                 parent = parent.Parent;
+                depth++;
             }
+            ThrowHelper.CheckDepthLimit(depth, useLargeLimit: true);
         }
     }
 }

src/Markdig/readme.md

@@ -0,0 +1,7 @@
+---
+uid: Markdig
+---
+
+# Summary
+
+Contains the top level classes for using Markdig. The entry user class is <xref:Markdig.Markdown>.

src/SpecFileGen/SpecFileGen.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <IsPackable>false</IsPackable>
   </PropertyGroup>
 

src/UnicodeNormDApp/UnicodeNormDApp.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <IsPackable>false</IsPackable>
   </PropertyGroup>
 </Project>

src/global.json

@@ -1,6 +1,7 @@
 {
-    "sdk": {
-        "version": "3.1.100",
-        "rollForward": "latestMinor"
-    }
+  "sdk": {
+    "version": "5.0.100",
+    "rollForward": "latestMinor",
+    "allowPrerelease": false
+  }
 }

src/markdig.sln.DotSettings

@@ -3,4 +3,7 @@
 This file is licensed under the BSD-Clause 2 license. 
 See the license.txt file in the project root for more information.</s:String>
 	<s:String x:Key="/Default/CodeStyle/Naming/CSharpNaming/PredefinedNamingRules/=PrivateInstanceFields/@EntryIndexedValue">&lt;Policy Inspect="True" Prefix="" Suffix="" Style="aaBb" /&gt;</s:String>
-	<s:String x:Key="/Default/Environment/UnitTesting/NUnitProvider/SetCurrentDirectoryTo/@EntryValue">TestFolder</s:String></wpf:ResourceDictionary>
+	<s:String x:Key="/Default/Environment/UnitTesting/NUnitProvider/SetCurrentDirectoryTo/@EntryValue">TestFolder</s:String>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=Autolink/@EntryIndexedValue">True</s:Boolean>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=Inlines/@EntryIndexedValue">True</s:Boolean>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=Markdig/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>

src/mdtoc/mdtoc.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <IsPackable>false</IsPackable>
   </PropertyGroup>
   <ItemGroup>