Fix quadratic-time backtracking when a reference link has no URL

A malformed reference definition line, one with a label but no URL
(just trailing whitespace after the colon), makes ReferenceProcessor's
regex backtrack badly. The pattern had two adjacent [ ]* groups around
an optional newline, both matching the same run of spaces, so for a
string of n spaces there were n+1 ways to split them before the engine
gave up and tried the next split. That turns markdown.markdown('[id]:'
+ ' ' * 50000) into an eight second call instead of a near-instant one,
and it gets worse fast as the input grows.

Rewrote the pattern so the leading run of spaces is consumed greedily
by a single group, with the optional newline plus more spaces folded
into one non-ambiguous alternative after it. Verified this produces
identical matches (and identical groups) as the old pattern on the
handful of valid reference-link shapes the tests already cover, and
added a dedicated regression test that fails on unmodified master and
passes with the fix.

Fixes #798.

Author: afonsojanu

docs/changelog.md

@@ -27,6 +27,9 @@ See the [Contributing Guide](contributing.md) for details.
 * Fix an issue with excessive backtracking when matching inline code blocks (#1617).
 * `md_in_html` now honors tags added to `Markdown.block_level_elements` after
   the extension is loaded (#1246).
+* Fix quadratic-time regex backtracking in `ReferenceProcessor` when a link
+  reference definition has no URL, e.g. a line consisting only of `[id]:`
+  followed by many trailing spaces (#798).
 
 ## [3.10.3] - 2026-07-30
 

markdown/blockprocessors.py

@@ -577,7 +577,8 @@ def run(self, parent: etree.Element, blocks: list[str]) -> None:
 class ReferenceProcessor(BlockProcessor):
     """ Process link references. """
     RE = re.compile(
-        r'^[ ]{0,3}\[([^\[\]]*)\]:[ ]*\n?[ ]*([^\s]+)[ ]*(?:\n[ ]*)?((["\'])(.*)\4[ ]*|\((.*)\)[ ]*)?$', re.MULTILINE
+        r'^[ ]{0,3}\[([^\[\]]*)\]:[ ]*(?:\n[ ]*)?([^\s]+)[ ]*(?:\n[ ]*)?((["\'])(.*)\4[ ]*|\((.*)\)[ ]*)?$',
+        re.MULTILINE
     )
 
     def test(self, parent: etree.Element, block: str) -> bool:

tests/test_syntax/blocks/test_reference_links.py

@@ -0,0 +1,62 @@
+"""
+Python Markdown
+
+A Python implementation of John Gruber's Markdown.
+
+Documentation: https://python-markdown.github.io/
+GitHub: https://github.com/Python-Markdown/markdown/
+PyPI: https://pypi.org/project/Markdown/
+
+Started by Manfred Stienstra (http://www.dwerg.net/).
+Maintained for a few years by Yuri Takhteyev (http://www.freewisdom.org).
+Currently maintained by Waylan Limberg (https://github.com/waylan),
+Dmitry Shachnev (https://github.com/mitya57) and Isaac Muse (https://github.com/facelessuser).
+
+Copyright 2007-2023 The Python Markdown Project (v. 1.7 and later)
+Copyright 2004, 2005, 2006 Yuri Takhteyev (v. 0.2-1.6b)
+Copyright 2004 Manfred Stienstra (the original version)
+
+License: BSD (see LICENSE.md for details).
+"""
+
+from markdown.test_tools import TestCase
+
+
+class TestReferenceLinks(TestCase):
+
+    def test_reference_link(self):
+        self.assertMarkdownRenders(
+            '[Text][id]\n\n[id]: http://example.com',
+            '<p><a href="http://example.com">Text</a></p>'
+        )
+
+    def test_reference_link_split_across_lines(self):
+        self.assertMarkdownRenders(
+            '[Text][id]\n\n[id]:\nhttp://example.com',
+            '<p><a href="http://example.com">Text</a></p>'
+        )
+
+    def test_reference_link_with_title(self):
+        self.assertMarkdownRenders(
+            '[Text][id]\n\n[id]: http://example.com "Title"',
+            '<p><a href="http://example.com" title="Title">Text</a></p>'
+        )
+
+    def test_reference_link_title_on_own_line(self):
+        self.assertMarkdownRenders(
+            '[Text][id]\n\n[id]: http://example.com\n"Title"',
+            '<p><a href="http://example.com" title="Title">Text</a></p>'
+        )
+
+    def test_malformed_reference_with_long_run_of_spaces(self):
+        """
+        A reference definition whose URL is missing (only trailing spaces
+        after the colon) should still be treated as plain text, no matter
+        how many trailing spaces there are.
+
+        See https://github.com/Python-Markdown/markdown/issues/798
+        """
+        text = '[id]:' + (' ' * 50000)
+        self.assertMarkdownRenders(
+            text, f'<p>{text}</p>', expected_attrs={'references': {}}
+        )