GHSA-cv23-7vc5-jfh7 gomarkdown/markdown IsSafeURL panics on short URLs

• Go github.com/gomarkdown/markdown: < 0.0.0-20260724235538-61af6e1e6971 → fixed in 0.0.0-20260724235538-61af6e1e6971

Summary IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022). The defect parser/parser.go, IsSafeURL: ```go func IsSafeURL(url []byte) bool { nLink := len(url) for _, path := range validPaths { // "/", "./", "../" nPath := len(path) linkPrefix := url[:nPath] // line 789: sliced BEFORE the length guard if nLink >= nPath && bytes.Equal(linkPrefix, path) { // line 790: guard is too late ... ``` url[:nPath] is evaluated before the `nLink >= nPath` check. When len(url) = nPath` first, then compute url[:nPath] (or use bytes.HasPrefix(url, path), which is length-safe). One-line change, mirroring the already-correct URIs loop. Also checked and sound: CVE-2026-40890 (smartypants smartLeftAngle OOB) is fixed; CVE-2024-44337 (list/paragraph infinite loop) is fixed (deep nesting capped at maxNesting=64); default XSS is by design (Safelink/SkipHTML not in CommonFlags). Tooling AI assistance was used while investigating. The panic is executed-verified with negative controls (IsSafeURL on empty/./.. panics with a slice-bounds error while "/" returns true; ToHTML with html.Safelink on `x` panics while valid and javascript: links do not), and I confirmed at HEAD that IsSafeURL computes url[:nPath] before the `nLink >= nPath` guard.