From e20dd0276e5bed6241e1432a938faa577f8ad5da Mon Sep 17 00:00:00 2001 From: Federico Soave Date: Thu, 8 Mar 2018 20:55:35 +0100 Subject: [PATCH] fix backtracking vulnerability in `block.pedantic.html` as in #1083 --- lib/marked.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/marked.js b/lib/marked.js index 233992e7d9..67cfc9c171 100644 --- a/lib/marked.js +++ b/lib/marked.js @@ -119,7 +119,7 @@ block.pedantic = merge({}, block.normal, { html: edit( '^ *(?:comment *(?:\\n|\\s*$)' + '|<(tag)[\\s\\S]+? *(?:\\n{2,}|\\s*$)' // closed tag - + '|]*)*?/?> *(?:\\n{2,}|\\s*$))') + + '|\\s]*)*?/?> *(?:\\n{2,}|\\s*$))') .replace('comment', block._comment) .replace(/tag/g, '(?!(?:' + 'a|em|strong|small|s|cite|q|dfn|abbr|data|time|code|var|samp|kbd|sub'