Fix panic in markdown link parsing (#10785)

utils/markdown/autolink.go

@@ -78,6 +78,10 @@ func parseURLAutolink(data string, position int) (Range, bool) {
 		start -= 1
 	}
 
+	if start < 0 || position >= len(data) {
+		return Range{}, false
+	}
+
 	// Ensure that the URL scheme is allowed and that at least one character after the scheme is valid.
 	scheme := data[start:position]
 	if !isSchemeAllowed(scheme) || !isValidHostCharacter(data[position+3:]) {

utils/markdown/autolink_test.go

@@ -130,6 +130,18 @@ func TestParseURLAutolink(t *testing.T) {
 			Position:    14,
 			Expected:    "http://example.com",
 		},
+		{
+			Description: "bad link protocol",
+			Input:       "://///",
+			Position:    0,
+			Expected:    "",
+		},
+		{
+			Description: "position greater than input length",
+			Input:       "there is no colon",
+			Position:    1000,
+			Expected:    "",
+		},
 	}
 
 	for _, testCase := range testCases {