TF-4224 Reduce ReDoS vulnerability

This commit is contained in:
Dang Dat
2025-12-24 13:43:40 +07:00
committed by Dat H. Pham
parent 91aacf39b7
commit 2b909aeb1c
5 changed files with 57 additions and 34 deletions
@@ -27,7 +27,7 @@ abstract class DomTransformer {
Tuple2<String, String>? findImageUrlFromStyleTag(String style) {
try {
final regExp = RegExp(r'background-image:\s*url\(([^)]+)\).*?');
final regExp = RegExp(r'''\bbackground-image\s*:\s*url\(\s*['"]?([^' ")]+)['"]?\s*\)''');
final match = regExp.firstMatch(style);
if (match == null) {
return null;
@@ -15,8 +15,9 @@ class NormalizeLineHeightInStyleTransformer extends DomTransformer {
Map<String, String>? mapUrlDownloadCID,
}) async {
try {
final alternation = _removableLineHeights.map(RegExp.escape).join('|');
final pattern = RegExp(
r'line-height\s*:\s*(?:' + _removableLineHeights.join('|') + r')\s*;?',
r'line-height\s*:\s*(?:' + alternation + r')\s*;?',
caseSensitive: false,
);
@@ -29,7 +30,7 @@ class NormalizeLineHeightInStyleTransformer extends DomTransformer {
var updatedStyle = originalStyle.replaceAll(pattern, '').trim();
// Remove extra spaces (>=2 spaces → 1 space)
updatedStyle = updatedStyle.replaceAll(RegExp(r'\s{2,}'), ' ');
updatedStyle = updatedStyle.replaceAll(RegExp(r' {2,}'), ' ');
if (updatedStyle != originalStyle) {
if (updatedStyle.isEmpty) {