fix with ReDoS security issue in purge.comments() (thanks @ready-rese…

…arch)
pyload · Sep 25, 2021 · 0ff11b5 · 0ff11b5
1 parent fbd9d7d
commit 0ff11b5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/pyload/core/utils/web/purge.py b/src/pyload/core/utils/web/purge.py
@@ -4,7 +4,7 @@
 import re
 from email.header import decode_header as decode_rfc2047_header
 
-_RE_COMMENTS = re.compile(r"<!--.*?-->", flags=re.S)
+_RE_COMMENTS = re.compile(r"<!--(?:(?!<!--).)*-->", flags=re.S)
 _RE_TAGS = re.compile(r"<[^<]+?>")
 _RE_RFC2047 = re.compile(r"=\?([^?]+)\?([QB])\?([^?]*)\?=")