Expand description
GitHub.com official anchor generation with security hardening
This module implements the exact anchor generation algorithm used by GitHub.com, verified through comprehensive testing with GitHub Gists, with comprehensive security hardening against injection attacks and DoS vectors.
Algorithm verified against GitHub.com (not third-party packages):
- Input validation and size limits (max 10KB)
- Unicode normalization (NFC) to prevent homograph attacks
- Dangerous Unicode filtering (RTL override, zero-width, control chars)
- Lowercase conversion
- Markdown formatting removal (*, `, []) with ReDoS-safe patterns
- Multi-character pattern replacement (–>, <->, ==>, ->)
- Special symbol replacement (& → –, © → –)
- Character processing (preserve letters, digits, underscores, hyphens)
- Space → single hyphen, emojis → single hyphen
- No leading/trailing trimming (unlike kramdown)
Security measures implemented:
- Input size limits to prevent memory exhaustion
- Unicode normalization to prevent homograph attacks
- Bidirectional text injection prevention
- Zero-width character stripping
- Control character filtering
- ReDoS-resistant regex patterns with complexity limits
- Comprehensive emoji detection including country flags and keycaps
Functions§
- heading_
to_ fragment - Generate GitHub.com style anchor fragment from heading text with security hardening