From 7a77fa4f645b92f97d55cbb7457bbc01064ee6e0 Mon Sep 17 00:00:00 2001
From: Yang Jun <harttleharttle@gmail.com>
Date: Mon, 11 May 2026 23:25:31 +0800
Subject: [PATCH] refactor(strip_html): drop position cache, delete dead blocks
 from Set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Once `indexOf(closer, X)` returns -1, all subsequent searches (with
monotonically increasing start) also return -1. So tracking absence is
enough; storing positions is unnecessary. Make `blocks` a Set and
delete a kind once its closer is known absent — no parallel `dead`
bookkeeping. Use Jest's per-test timeout for the ReDoS regressions
instead of manual Date.now() bookkeeping.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/filters/html.ts                 | 19 +++++++------------
 test/integration/liquid/dos.spec.ts | 22 +++++++---------------
 2 files changed, 14 insertions(+), 27 deletions(-)

diff --git a/src/filters/html.ts b/src/filters/html.ts
index fb8096aef..e59adfd58 100644
--- a/src/filters/html.ts
+++ b/src/filters/html.ts
@@ -42,16 +42,11 @@ export function newline_to_br (this: FilterImpl, v: string) {
   return str.replace(/\r?\n/gm, '<br />\n')
 }
 
-// <script>, <style>, and <!--...--> are raw-text blocks (HTML5): their content is
-// opaque until the matching closer, so a `>` inside CSS/JS/comment does not end them.
-// Same set as Shopify Liquid's STRIP_HTML_BLOCKS. Everything else is a generic <...>.
-// We scan with indexOf and cache the next known closer per kind, keeping total work
-// O(n); a regex equivalent is O(n^2) in V8 (no atomic groups / memoization).
+// Raw-text blocks (HTML5): a regex equivalent is O(n^2) in V8 on unclosed openers.
 export function strip_html (this: FilterImpl, v: string) {
   const str = stringify(v)
   this.context.memoryLimit.use(str.length)
-  const blocks: [string, string][] = [['<script', '</script>'], ['<style', '</style>'], ['<!--', '-->']]
-  const closes = [0, 0, 0]
+  const blocks = new Set<[string, string]>([['<script', '</script>'], ['<style', '</style>'], ['<!--', '-->']])
   let out = ''
   let i = 0
   while (i < str.length) {
@@ -59,12 +54,12 @@ export function strip_html (this: FilterImpl, v: string) {
     if (lt < 0) return out + str.slice(i)
     out += str.slice(i, lt)
     let end = -1
-    for (let k = 0; k < blocks.length; k++) {
-      const [opener, closer] = blocks[k]
+    for (const block of blocks) {
+      const [opener, closer] = block
       if (!str.startsWith(opener, lt)) continue
-      const from = lt + opener.length
-      if (closes[k] >= 0 && closes[k] < from) closes[k] = str.indexOf(closer, from)
-      if (closes[k] >= 0) end = closes[k] + closer.length
+      const e = str.indexOf(closer, lt + opener.length)
+      if (e < 0) blocks.delete(block)
+      else end = e + closer.length
       break
     }
     if (end < 0) end = str.indexOf('>', lt + 1) + 1
diff --git a/test/integration/liquid/dos.spec.ts b/test/integration/liquid/dos.spec.ts
index 4b6cfd0df..85783564e 100644
--- a/test/integration/liquid/dos.spec.ts
+++ b/test/integration/liquid/dos.spec.ts
@@ -88,29 +88,21 @@ describe('DoS related', function () {
   describe('strip_html ReDoS', () => {
     // Regression for O(n^2) backtracking on unclosed `<script` / `<style` openers.
     // The previous regex stalled the event loop for ~10s on 350KB of `'<script'.repeat`.
+    // The per-test timeout below caps total time; an O(n^2) regression would blow it.
     it('should handle many unclosed <script openers in linear time', () => {
       const liquid = new Liquid()
       const payload = '<script'.repeat(50000)
-      const t0 = Date.now()
-      const out = liquid.parseAndRenderSync('{{ x | strip_html }}', { x: payload })
-      expect(Date.now() - t0).toBeLessThan(1000)
-      expect(out).toBe(payload)
-    })
+      expect(liquid.parseAndRenderSync('{{ x | strip_html }}', { x: payload })).toBe(payload)
+    }, 1000)
     it('should handle many unclosed <style openers in linear time', () => {
       const liquid = new Liquid()
       const payload = '<style'.repeat(50000)
-      const t0 = Date.now()
-      const out = liquid.parseAndRenderSync('{{ x | strip_html }}', { x: payload })
-      expect(Date.now() - t0).toBeLessThan(1000)
-      expect(out).toBe(payload)
-    })
+      expect(liquid.parseAndRenderSync('{{ x | strip_html }}', { x: payload })).toBe(payload)
+    }, 1000)
     it('should handle <script openers that have > but no </script> in linear time', () => {
       const liquid = new Liquid()
       const payload = '<script>foo'.repeat(50000)
-      const t0 = Date.now()
-      const out = liquid.parseAndRenderSync('{{ x | strip_html }}', { x: payload })
-      expect(Date.now() - t0).toBeLessThan(1000)
-      expect(out).toBe('foo'.repeat(50000))
-    })
+      expect(liquid.parseAndRenderSync('{{ x | strip_html }}', { x: payload })).toBe('foo'.repeat(50000))
+    }, 1000)
   })
 })