Yang JunandCursor 2803730a14 fix(strip_html): rewrite as linear single-pass scan to avoid ReDoS ...

The previous strip_html regex
  /<script[\s\S]*?<\/script>|<style[\s\S]*?<\/style>|<[\s\S]*?>|<!--[\s\S]*?-->/g
contains lazy alternatives that backtrack O(n^2) on inputs with many
unclosed `<script` / `<style` openers. A 350KB payload of
`'<script'.repeat(50000)` blocked the Node.js event loop for ~10s, and
cost grew quadratically with input size. memoryLimit only charged
str.length, which does not bound regex CPU.

Replace the regex with an indexOf-based single-pass scan. For each `<`
we:
- if `<script` opener: find next `</script>` and skip the whole block;
  cache "no closer after pos k" so subsequent unclosed `<script`
  openers do not re-scan the tail.
- same for `<style` / `</style>`.
- otherwise treat as a generic `<...>` tag (matches the original
  behavior, where the `<[\s\S]*?>` alternative also caught comments).
- if no closing `>` exists, emit the tail as literal text and stop.

Total work is O(n). All existing strip_html test cases pass unchanged.

Add regression tests covering the PoCs (`<script` / `<style` repeats,
and `<script>foo` repeats with `>` but no `</script>`) plus a
memoryLimit assertion.

Co-authored-by: Cursor <[email protected]>

2026-05-10 14:47:06 +08:00

..

demo

test: refactor test:demo script into demo/*/test.sh

2024-08-29 01:30:25 +08:00

e2e

fix: nested block for layout (#883)

2026-04-19 23:41:35 +08:00

integration

fix(strip_html): rewrite as linear single-pass scan to avoid ReDoS

2026-05-10 14:47:06 +08:00

stub

fix: use realpath for fs.contains (#867)

2026-04-06 14:40:35 +08:00

.eslintrc.json

chore: split Github Actions workflows

2023-06-05 23:32:35 +08:00

tsconfig.json

fix: path traversal vulnerability, #851 (#855)

2026-03-08 02:36:09 +08:00