From 8da970cd2ccb0c4d38c2d0f7dcb51700e519cdf4 Mon Sep 17 00:00:00 2001
From: Tony Brix <tony@brix.ninja>
Date: Tue, 9 Apr 2019 10:17:02 -0500
Subject: [PATCH] no recursion for nested blockquotes

---
 lib/marked.js | 36 ++++++++++++++++++++++++++++++------
 1 file changed, 30 insertions(+), 6 deletions(-)

diff --git a/lib/marked.js b/lib/marked.js
index 39c25f2610..f87970e1e6 100644
--- a/lib/marked.js
+++ b/lib/marked.js
@@ -299,16 +299,26 @@ Lexer.prototype.token = function(src, top) {
         type: 'blockquote_start'
       });
 
-      cap = cap[0].replace(/^ *> ?/gm, '');
+      var blockquote = cap[0].replace(/^ *> ?/gm, '');
+      var count = 1;
+      while (blockquote.match(/^ {0,3}>/)) {
+        count++;
+        this.tokens.push({
+          type: 'blockquote_start'
+        });
+        blockquote = blockquote.replace(/^ *> ?/gm, '');
+      }
 
       // Pass `top` to keep the current
       // "toplevel" state. This is exactly
       // how markdown.pl works.
-      this.token(cap, top);
+      this.token(blockquote, top);
 
-      this.tokens.push({
-        type: 'blockquote_end'
-      });
+      for (i = 0; i < count; i++) {
+        this.tokens.push({
+          type: 'blockquote_end'
+        });
+      }
 
       continue;
     }
@@ -1233,13 +1243,27 @@ Parser.prototype.tok = function() {
       return this.renderer.table(header, body);
     }
     case 'blockquote_start': {
+      var count = 1;
+      while (this.peek() && this.peek().type === 'blockquote_start') {
+        this.next();
+        count++;
+      }
+
       body = '';
 
       while (this.next().type !== 'blockquote_end') {
         body += this.tok();
       }
 
-      return this.renderer.blockquote(body);
+      while (this.peek() && this.peek().type === 'blockquote_end') {
+        this.next();
+      }
+
+      for (i = 0; i < count; i++) {
+        body = this.renderer.blockquote(body);
+      }
+
+      return body;
     }
     case 'list_start': {
       body = '';