From 48448cc24f3576319e72b6dd29c85ea4dc05b8f0 Mon Sep 17 00:00:00 2001
From: Tony Brix <tony@brix.ninja>
Date: Tue, 19 May 2020 15:40:49 -0500
Subject: [PATCH 1/2] fix image links with escaped brackets

---
 src/Tokenizer.js                |  7 ++++---
 src/rules.js                    |  2 +-
 test/specs/new/image_links.html | 11 +++++++++++
 test/specs/new/image_links.md   |  3 +++
 4 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 test/specs/new/image_links.html
 create mode 100644 test/specs/new/image_links.md

diff --git a/src/Tokenizer.js b/src/Tokenizer.js
index e3ff002b77..afe252fb41 100644
--- a/src/Tokenizer.js
+++ b/src/Tokenizer.js
@@ -9,6 +9,7 @@ const {
 function outputLink(cap, link, raw) {
   const href = link.href;
   const title = link.title ? escape(link.title) : null;
+  const text = cap[1].replace(/\\([\[\]])/g, '$1');
 
   if (cap[0].charAt(0) !== '!') {
     return {
@@ -16,15 +17,15 @@ function outputLink(cap, link, raw) {
       raw,
       href,
       title,
-      text: cap[1]
+      text
     };
   } else {
     return {
       type: 'image',
       raw,
-      text: escape(cap[1]),
       href,
-      title
+      title,
+      text: escape(text)
     };
   }
 }
diff --git a/src/rules.js b/src/rules.js
index d6c16521cb..60241f5ee8 100644
--- a/src/rules.js
+++ b/src/rules.js
@@ -198,7 +198,7 @@ inline.tag = edit(inline.tag)
   .replace('attribute', inline._attribute)
   .getRegex();
 
-inline._label = /(?:\[[^\[\]]*\]|\\.|`[^`]*`|[^\[\]\\`])*?/;
+inline._label = /(?:\[(?:\\.|[^\[\]])*\]|\\.|`[^`]*`|[^\[\]\\`])*?/;
 inline._href = /<(?:\\[<>]?|[^\s<>\\])*>|[^\s\x00-\x1f]*/;
 inline._title = /"(?:\\"?|[^"\\])*"|'(?:\\'?|[^'\\])*'|\((?:\\\)?|[^)\\])*\)/;
 
diff --git a/test/specs/new/image_links.html b/test/specs/new/image_links.html
new file mode 100644
index 0000000000..3f2828c536
--- /dev/null
+++ b/test/specs/new/image_links.html
@@ -0,0 +1,11 @@
+<p>
+	<a href="https://example.com/">
+		<img src="https://example.com/image.jpg" alt="test" title="title" />
+	</a>
+</p>
+
+<p>
+	<a href="https://example.com/">
+		<img src="https://example.com/image.jpg" alt="[test]" title="[title]" />
+	</a>
+</p>
diff --git a/test/specs/new/image_links.md b/test/specs/new/image_links.md
new file mode 100644
index 0000000000..109603266e
--- /dev/null
+++ b/test/specs/new/image_links.md
@@ -0,0 +1,3 @@
+[![test](https://example.com/image.jpg "title")](https://example.com/)
+
+[![\[test\]](https://example.com/image.jpg "[title]")](https://example.com/)

From d57c89d00e3173d0f03ca66cbf810aa841307dfa Mon Sep 17 00:00:00 2001
From: Tony Brix <tony@brix.ninja>
Date: Wed, 20 May 2020 10:23:42 -0500
Subject: [PATCH 2/2] fix redos

---
 src/rules.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/rules.js b/src/rules.js
index 60241f5ee8..b34f56ff8f 100644
--- a/src/rules.js
+++ b/src/rules.js
@@ -198,7 +198,7 @@ inline.tag = edit(inline.tag)
   .replace('attribute', inline._attribute)
   .getRegex();
 
-inline._label = /(?:\[(?:\\.|[^\[\]])*\]|\\.|`[^`]*`|[^\[\]\\`])*?/;
+inline._label = /(?:\[(?:\\.|[^\[\]\\])*\]|\\.|`[^`]*`|[^\[\]\\`])*?/;
 inline._href = /<(?:\\[<>]?|[^\s<>\\])*>|[^\s\x00-\x1f]*/;
 inline._title = /"(?:\\"?|[^"\\])*"|'(?:\\'?|[^'\\])*'|\((?:\\\)?|[^)\\])*\)/;