Fix CVE-2023-31606 (ReDOS possible in the sanitize_html function) (#75)

* make regex faster with Atomic Grouping * simplify fix
jgarber · Nov 2, 2023 · 8b13276 · 8b13276
1 parent dd7ee6c
commit 8b13276
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/redcloth/formatters/html.rb b/lib/redcloth/formatters/html.rb
@@ -324,7 +324,7 @@ def before_transform(text)
   # Clean unauthorized tags.
   def clean_html( text, allowed_tags = BASIC_TAGS )
     text.gsub!( /<!\[CDATA\[/, '' )
-    text.gsub!( /<(\/*)([A-Za-z]\w*)([^>]*?)(\s?\/?)>/ ) do |m|
+    text.gsub!( /<(\/*)([A-Za-z]\w*+)([^>]*?)(\s?\/?)>/ ) do |m|
       raw = $~
       tag = raw[2].downcase
       if allowed_tags.has_key? tag