From bd4f8c464befad2b304d51e33e89e567326e62e0 Mon Sep 17 00:00:00 2001 From: Trevor Buckner Date: Thu, 2 Jul 2020 11:59:31 -0400 Subject: [PATCH] Fix unrestricted "any character" for REDOS And remove redundant unused capture group. --- src/rules.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/rules.js b/src/rules.js index 19b420e97f..6c9269ef6f 100644 --- a/src/rules.js +++ b/src/rules.js @@ -173,7 +173,7 @@ const inline = { strong: /^(?:(\*\*(?=[*punctuation]))|\*\*)(?![\s])((?:(?:(?!emSkip)(?:[^*]|[\\\s]\*)|emSkip)|(?:(?:(?!emSkip)(?:[^*]|[\\\s]\*)|emSkip)*?(??@\\[\\]`^{|}~'; inline.punctuation = edit(inline.punctuation).replace(/punctuation/g, inline._punctuation).getRegex(); // sequences em should skip over [title](link), `code`, -inline._emSkip = '\\[.*?\\]\\(.*?\\)|`.*?`|<.*?>'; +inline._emSkip = '\\[[^\\]]*?\\]\\([^\\)]*?\\)|`[^`]*?`|<[^>]*?>'; inline.em = edit(inline.em) .replace(/punctuation/g, inline._punctuation)