From f88550121f48e5b22eaac56486dce31dce2867c8 Mon Sep 17 00:00:00 2001 From: y0d4a Date: Fri, 14 Aug 2026 11:45:26 +0200 Subject: [PATCH 1/2] Fix ReDoS in stripHtml --- lib/utils.js | 4 ++-- test/html.js | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/lib/utils.js b/lib/utils.js index f1e736f..3432b1a 100644 --- a/lib/utils.js +++ b/lib/utils.js @@ -3,8 +3,8 @@ const entities = require('entities'); const xml2js = require('xml2js'); utils.stripHtml = function(str) { - str = str.replace(/([^\n])<\/?(h|br|p|ul|ol|li|blockquote|section|table|tr|div)(?:.|\n)*?>([^\n])/gm, '$1\n$3') - str = str.replace(/<(?:.|\n)*?>/gm, ''); + str = str.replace(/([^\n])<\/?(h|br|p|ul|ol|li|blockquote|section|table|tr|div)[^<>]*>([^\n])/gm, '$1\n$3') + str = str.replace(/<[^<>]*>/gm, ''); return str; } diff --git a/test/html.js b/test/html.js index b93ffb9..eb69fb8 100644 --- a/test/html.js +++ b/test/html.js @@ -41,5 +41,10 @@ describe('Utils', function() { Expect('|' + utils.getSnippet(tc.input) + '|').to.equal('|' + tc.output + '|', tc.input); }); }) + + it('should handle repeated unterminated HTML tags efficiently', () => { + var input = 'a Date: Thu, 20 Aug 2026 20:58:29 +0200 Subject: [PATCH 2/2] Make ReDoS regression timeout explicit --- test/html.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/html.js b/test/html.js index eb69fb8..84948b5 100644 --- a/test/html.js +++ b/test/html.js @@ -42,7 +42,8 @@ describe('Utils', function() { }); }) - it('should handle repeated unterminated HTML tags efficiently', () => { + it('should handle repeated unterminated HTML tags efficiently', function() { + this.timeout(2000); var input = 'a