Quellcode durchsuchen

SimplePie Fix regex backtrack limit in clean_hash() (#7813)

https://github.com/FreshRSS/simplepie/pull/48
and merge upstream https://github.com/FreshRSS/simplepie/pull/49
fix https://github.com/FreshRSS/FreshRSS/issues/7807
We had a risk of hitting `Backtrack limit was exhausted` in case of open XML comment `<!--` not closed and followed by a very long document.
Fixed by:
* Limiting the max length of the comment
* Stopping at an apparent end of CDATA section `]]>` as it is likely an error

It does not matter much if there are rare cases when the regex does not work perfectly, as it is only used for a cache hint.
Alexandre Alapetite vor 7 Monaten
Ursprung
Commit
eaf69f591f

+ 1 - 1
lib/composer.json

@@ -14,7 +14,7 @@
         "marienfressinaud/lib_opml": "0.5.1",
         "phpgt/cssxpath": "v1.3.0",
         "phpmailer/phpmailer": "6.10.0",
-        "simplepie/simplepie": "dev-freshrss#3cdee69fde431e6b461b87413177a791c2018098"
+        "simplepie/simplepie": "dev-freshrss#dcaa720d3d8bc8202333f569c4cddb4a407dc213"
     },
     "config": {
         "sort-packages": true,

+ 0 - 0
lib/simplepie/simplepie/phpstan.neon.dist → lib/simplepie/simplepie/phpstan.dist.neon


+ 1 - 1
lib/simplepie/simplepie/src/SimplePie.php

@@ -1695,7 +1695,7 @@ class SimplePie
                         [
                             '#<(lastBuildDate|pubDate|updated|feedDate|dc:date|slash:comments)>[^<]+</\\1>#',
                             '#<(media:starRating|media:statistics) [^/<>]+/>#',
-                            '#<!--.+?-->#s',
+                            '#<!--.{,8192}?(-->|(?=]]>))#s', // XML comments up to a max length and stops at apparent end of CDATA section
                         ],
                         '',
                         $stream_data