I have an application where users can submit small snippets of markdown to a server. The server can gather a bunch of these and add them to a report. I wanted to perform some quick and simple validation when the user submits markdown, so the server doesn't go boom when it tries to generate the reports.

The de-facto standard markdown processor appears to be pulldown-cmark, so I figured I'd make a dummy processor that just runs though the document on user submission, but doesn't actually output anything. I quickly discovered that it doesn't have an Error type. So I did some googling and found two different, somewhat contradictory, statements.

One person said that markdown doesn't really have "errors" at that level. Parsers/processors will purposely just trudge on and try its best. You can check for errors, but that's more for high level constructs. ("Does this document support heading level 3", "does this link to a valid location", etc).

Another person said, about pulldown-cmark specifically (and I'm paraphrasing): "If you can run the parser over the document without it panicing, then the document is free of errors.".

I find it difficult to believe that pulldown-cmark would be designed to panic on a missing code block terminator, so I'm more inclined to believe the first statement. Is this correct?

(Although the data in question isn't particularly important, I don't want to introduce a trivial denial of service vector into the server).

2 posts - 2 participants

Read full topic