Changeset 43955 for branches/5.0/src/wp-includes/class-wp-block-parser.php

Timestamp:

11/30/2018 08:57:02 PM (6 years ago)

Author:

youknowriad

Message:

Block Editor: Update @wordpress package dependencies.

Updated packages

• @wordpress/block-library@2.2.9
• @wordpress/block-serialization-default-parser@2.0.1
• @wordpress/block-serialization-spec-parser@2.0.1
• @wordpress/blocks@6.0.3
• @wordpress/edit-post@3.1.4
• @wordpress/editor@9.0.4
• @wordpress/format-library@1.2.7

Other changes:

• Backport the parser changes.

Fixes #45145.

File:

• branches/5.0/src/wp-includes/class-wp-block-parser.php (modified) (3 diffs)

branches/5.0/src/wp-includes/class-wp-block-parser.php

@@ -360 +360 @@
      * @internal
      * @since 3.8.0
+     * @since 4.6.1 fixed a bug in attribute parsing which caused catastrophic backtracking on invalid block comments
      * @return array
      */
@@ -374 +375 @@
          */
         $has_match = preg_match(
-            '/<!--\s+(?<closer>\/)?wp:(?<namespace>[a-z][a-z0-9_-]*\/)?(?<name>[a-z][a-z0-9_-]*)\s+(?<attrs>{(?:[^}]+|}+(?=})|(?!}\s+-->).)*?}\s+)?(?<void>\/)?-->/s',
+            '/<!--\s+(?<closer>\/)?wp:(?<namespace>[a-z][a-z0-9_-]*\/)?(?<name>[a-z][a-z0-9_-]*)\s+(?<attrs>{(?:(?:[^}]+|}+(?=})|(?!}\s+\/?-->).)*+)?}\s+)?(?<void>\/)?-->/s',
             $this->document,
             $matches,
@@ -380 +381 @@
             $this->offset
         );
+
+        // if we get here we probably have catastrophic backtracking or out-of-memory in the PCRE
+        if ( false === $has_match ) {
+            return array( 'no-more-tokens', null, null, null, null );
+        }
 
         // we have no more tokens