From 11dfe9274fb358008bd7eb7718b3901a87afcea4 Mon Sep 17 00:00:00 2001 From: Erik Krogh Kristensen Date: Thu, 12 Nov 2020 17:20:34 +0100 Subject: [PATCH] fix catastrophic backtracking when removing HTML comments (#40223) * fix catastrophic backtracking when removing HTML comments The regexp `//g` can experience catastrophic backtracking while matching a string like ``). [You can see the catastrophic backtracking in action here](https://regex101.com/r/2jvwFi/1/debugger). This is because both `.` and `\s` matches the space character, and there are therefore a large number of possible ways for `(.|\s)*` to match a long sequence of spaces. The regexp evaluator is greedy, and the problem therefore only exists when the string does not match the regexp. The fix is simply to remove the ambiguity such that there is only one possible way for the regexp to match a sequence of white-space. * Update client/src/utils/curriculum-helpers.js Co-authored-by: Oliver Eyton-Williams Co-authored-by: Oliver Eyton-Williams --- client/src/utils/curriculum-helpers.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/src/utils/curriculum-helpers.js b/client/src/utils/curriculum-helpers.js index fc9699dd0a..e1b5b94f0b 100644 --- a/client/src/utils/curriculum-helpers.js +++ b/client/src/utils/curriculum-helpers.js @@ -1,7 +1,7 @@ import { parse } from '@babel/parser'; import generate from '@babel/generator'; -const removeHtmlComments = str => str.replace(//g, ''); +const removeHtmlComments = str => str.replace(//gs, ''); const removeCssComments = str => str.replace(/\/\*[\s\S]+?\*\//g, '');