fix: restrict markdown cache to built-in selectors

Author: lepture

src/mistune/__init__.py

@@ -64,11 +64,11 @@ def create_markdown(
 html: Markdown = create_markdown(escape=False, plugins=["strikethrough", "footnotes", "table"])
 
 
-BuiltinRendererRef = Optional[Literal["html", "ast"]]
+_BuiltinRendererRef = Optional[Literal["html", "ast"]]
 
 
 @lru_cache(maxsize=128)
-def _cached_markdown(escape: bool, renderer: BuiltinRendererRef, plugins: Tuple[str, ...]) -> Markdown:
+def _cached_markdown(escape: bool, renderer: _BuiltinRendererRef, plugins: Tuple[str, ...]) -> Markdown:
     return create_markdown(escape=escape, renderer=renderer, plugins=plugins)
 
 
@@ -79,7 +79,7 @@ def markdown(
     plugins: Optional[Iterable[Any]] = None,
 ) -> Union[str, List[Dict[str, Any]]]:
     plugin_refs = tuple(plugins) if plugins is not None else ()
-    if (renderer is None or renderer == "html" or renderer == "ast") and all(
+    if (renderer is None or (isinstance(renderer, str) and renderer in ("html", "ast"))) and all(
         isinstance(plugin, str) for plugin in plugin_refs
     ):
         md = _cached_markdown(escape, renderer, plugin_refs)

tests/test_misc.py

@@ -337,6 +337,17 @@ def test_markdown_func_does_not_cache_custom_renderer(self):
         self.assertEqual(mistune.markdown(text, escape=False, renderer=renderer).strip(), "<p><b>hi</b></p>")
         self.assertEqual(mistune.markdown(text, escape=True, renderer=renderer).strip(), "<p>&lt;b&gt;hi&lt;/b&gt;</p>")
 
+    def test_markdown_func_does_not_treat_equal_renderer_as_builtin(self):
+        class EqualRenderer(mistune.HTMLRenderer):
+            __hash__ = None
+
+            def __eq__(self, other):
+                return other == "html"
+
+        renderer = EqualRenderer()
+
+        self.assertEqual(mistune.markdown("<b>x</b>", renderer=renderer).strip(), "<p>&lt;b&gt;x&lt;/b&gt;</p>")
+
     def test_markdown_func_cache_eviction_preserves_output(self):
         expected = "<p><strong>b</strong></p>\n"
         self.assertEqual(mistune.markdown("**b**"), expected)