fix: Addressed a conditional bypass pattern spotted by @Ry0taK

fix: Addressed a conditional ReDoS issue spotted by @Ry0taK
cure53 · Mar 20, 2024 · dce81a5 · dce81a5
1 parent 51eea81
commit dce81a5
Show file tree

Hide file tree

Showing 11 changed files with 1,185 additions and 597 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.mjs b/dist/purify.es.mjs
diff --git a/dist/purify.es.mjs.map b/dist/purify.es.mjs.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -1009,6 +1009,12 @@ function createDOMPurify(window = getGlobal()) {
       return true;
     }
 
+    /* Remove any ocurrence of processing instructions */
+    if (currentNode.nodeType === 7) {
+      _forceRemove(currentNode);
+      return true;
+    }
+
     /* Remove element if anything forbids its presence */
     if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
       /* Check if we have a custom element to handle */

diff --git a/src/regexp.js b/src/regexp.js
@@ -1,9 +1,9 @@
 import { seal } from './utils.js';
 
 // eslint-disable-next-line unicorn/better-regex
-export const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
-export const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
-export const TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
+export const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*?\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
+export const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*?%>/gm);
+export const TMPLIT_EXPR = seal(/\${[\w\W]*?}/gm);
 export const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
 export const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
 export const IS_ALLOWED_URI = seal(

diff --git a/test/test-suite.js b/test/test-suite.js
@@ -378,7 +378,7 @@
           '<a>123{{45}}6}}<b><style><% <%alert(1) %></style>456</b></a>',
           { SAFE_FOR_TEMPLATES: true }
         ),
-        '<a> <b><style> </style>456</b></a>'
+        '<a>  <b><style> </style>456</b></a>'
       );
       assert.equal(
         DOMPurify.sanitize(