Disallow square brackets in reference link ids.

docs/change_log/index.md

@@ -3,6 +3,10 @@ title: Change Log
 Python-Markdown Change Log
 =========================
 
+(under development): version 3.3.7 (a bug-fix release).
+
+* Disallow square brackets in reference link ids (#1209).
+
 Nov 17, 2021: version 3.3.6 (a bug-fix release).
 
 * Fix a dependency issue (#1195, #1196).

markdown/blockprocessors.py

@@ -559,7 +559,7 @@ def run(self, parent, blocks):
 class ReferenceProcessor(BlockProcessor):
     """ Process link references. """
     RE = re.compile(
-        r'^[ ]{0,3}\[([^\]]*)\]:[ ]*\n?[ ]*([^\s]+)[ ]*(?:\n[ ]*)?((["\'])(.*)\4[ ]*|\((.*)\)[ ]*)?$', re.MULTILINE
+        r'^[ ]{0,3}\[([^\[\]]*)\]:[ ]*\n?[ ]*([^\s]+)[ ]*(?:\n[ ]*)?((["\'])(.*)\4[ ]*|\((.*)\)[ ]*)?$', re.MULTILINE
     )
 
     def test(self, parent, block):

tests/test_syntax/inline/test_links.py

@@ -350,3 +350,37 @@ def test_reference_across_blocks(self):
             '<p>I would like to tell you about the [code of</p>\n'
             '<p>conduct][] we are using in this project.</p>'
         )
+
+    def test_ref_link_nested_left_bracket(self):
+        self.assertMarkdownRenders(
+            self.dedent(
+                """
+                [Text[]
+
+                [Text[]: http://example.com
+                """
+            ),
+            self.dedent(
+                """
+                <p>[Text[]</p>
+                <p>[Text[]: http://example.com</p>
+                """
+            )
+        )
+
+    def test_ref_link_nested_right_bracket(self):
+        self.assertMarkdownRenders(
+            self.dedent(
+                """
+                [Text]]
+
+                [Text]]: http://example.com
+                """
+            ),
+            self.dedent(
+                """
+                <p>[Text]]</p>
+                <p>[Text]]: http://example.com</p>
+                """
+            )
+        )