ReDoS in SCSS processor

[dvasquez-7]

Hello,

I'm a security researcher at Sonatype, and I discovered a potential vulnerability in this project. Do you have a preferred way for me to share the details privately, or do you want me to just show you what I've got on this GitHub issue?

[RunDevelopment]

Thank you for asking before sharing the vulnerability @dvasquez-7.

Please message me at my private email address and then we can discuss the issue there.

[RunDevelopment]

As discussed in the email, the issue found was a case of quadratic runtime caused by the pattern being moved across the string. This type of super-linear worst-case is

1. Hard to fix. I believe it to impossible for most regexes.
2. Somewhat acceptable. Quadratic runtime typically takes 10k characters of text to reach 1 second.

I'll close this issue now.

If there are any questions/suggestions/objects, then I'll gladly answer/respond to them either in this comment thread or my private email linked above and in my GitHub profile.