fix: bound document nesting and escape generated urls

core/src/error.rs

@@ -26,6 +26,11 @@ pub enum Error {
     /// name is a typo or a missing cargo feature.
     UnknownFormat { listener: String, format: String, available: Vec<String> },
 
+    /// A document nests blocks or inlines deeper than the parser allows. Refused
+    /// rather than parsed, because every walk over the result recurses and a
+    /// stack overflow aborts the process rather than unwinding.
+    TooDeep { limit: usize },
+
     /// An include or ASCII-art target cannot be used. `path` is where the
     /// directive actually pointed, resolved, which is the thing an author needs
     /// to see when a relative target is wrong.
@@ -68,6 +73,9 @@ impl fmt::Display for Error {
             Error::DuplicateHost { host, first, second } => {
                 write!(f, "host '{host}' is claimed by both site '{first}' and site '{second}'")
             }
+            Error::TooDeep { limit } => {
+                write!(f, "document nests more than {limit} levels deep")
+            }
             Error::Include { path, reason } => {
                 write!(f, "include target {} {reason}", path.display())
             }