Skip to content

Catastrophic backtracking #82

@bytestream

Description

@bytestream

The comment regex in https://github.com/xemlock/htmlpurifier-html5/blob/master/library/HTMLPurifier/Lexer/HTML5.php#L57 can cause catastrophic back tracking. The result is preg_replace_callback returns null

Workaround is to increase pcre.backtrack_limit. However, I think it would be better if the error handling in this function is improved to account for when preg_replace_callback returns null. I expect that it would just skip that comment regex functionality in that case.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions