Skip to content

Commit 8b13276

Browse files
authored
Fix CVE-2023-31606 (ReDOS possible in the sanitize_html function) (#75)
* make regex faster with Atomic Grouping * simplify fix
1 parent dd7ee6c commit 8b13276

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

lib/redcloth/formatters/html.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -324,7 +324,7 @@ def before_transform(text)
324324
# Clean unauthorized tags.
325325
def clean_html( text, allowed_tags = BASIC_TAGS )
326326
text.gsub!( /<!\[CDATA\[/, '' )
327-
text.gsub!( /<(\/*)([A-Za-z]\w*)([^>]*?)(\s?\/?)>/ ) do |m|
327+
text.gsub!( /<(\/*)([A-Za-z]\w*+)([^>]*?)(\s?\/?)>/ ) do |m|
328328
raw = $~
329329
tag = raw[2].downcase
330330
if allowed_tags.has_key? tag

0 commit comments

Comments
 (0)