Speed up regex against ddos attacks.

Author: koculu

packages/ts-format/src/fences.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, it } from 'vitest'
+import {
+  buildMdxFenceDelimiterEdits,
+  type MdxFence,
+  maskMdxFencedRegions,
+  parseInlineMdxFenceCloser,
+  parseInlineMdxFenceOpener,
+  restoreMdxFencedRegions,
+} from './fences'
+import { applySourceEdits, SourceText } from './source'
+
+describe('inline fence delimiters', () => {
+  it.each(['```', '````', '~~~', '~~~~~~'])(
+    'preserves %s marker length, fence info, content, and repeated-format stability',
+    (fence) => {
+      const source = `before \t${fence}mdx title="Example"\n  <Panel />\nafter \t${fence}\t `
+      const expected = `before\n${fence}mdx title="Example"\n  <Panel />\nafter\n${fence}`
+      const edits = buildMdxFenceDelimiterEdits(new SourceText(source), [])
+      expect(applySourceEdits(source, edits)).toBe(expected)
+      expect(buildMdxFenceDelimiterEdits(new SourceText(expected), [])).toEqual(
+        [],
+      )
+      const { fences, placeholderContent } = maskMdxFencedRegions(source)
+      expect(restoreMdxFencedRegions(placeholderContent, fences)).toBe(expected)
+    },
+  )
+
+  it('uses the first inline opener and preserves its complete suffix', () => {
+    expect(parseInlineMdxFenceOpener('before ~~ ````mdx ~~~')).toEqual({
+      marker: '`',
+      length: 4,
+      suffix: 'mdx ~~~',
+    })
+    expect(parseInlineMdxFenceOpener(' \t```mdx')).toBeUndefined()
+    expect(parseInlineMdxFenceOpener('before `` ~ around')).toBeUndefined()
+  })
+
+  it('accepts longer closing fences on either side and rejects shorter or different markers', () => {
+    const active: MdxFence = { marker: '`', length: 4 }
+    expect(parseInlineMdxFenceCloser('before \t`````\t ', active)).toEqual({
+      marker: '`',
+      length: 5,
+      suffix: '',
+    })
+    expect(parseInlineMdxFenceCloser('\t`````<Panel/>', active)).toEqual({
+      marker: '`',
+      length: 5,
+      suffix: '',
+    })
+    for (const line of [
+      'before ```',
+      'before ~~~~',
+      'before ```` x',
+      'before ````\u00a0',
+    ]) {
+      expect(parseInlineMdxFenceCloser(line, active)).toBeUndefined()
+    }
+  })
+
+  it('preserves CRLF and honors excluded ranges', () => {
+    const source = 'before ```mdx\r\n<Panel /> ```\r\n'
+    const document = new SourceText(source)
+    const edits = buildMdxFenceDelimiterEdits(document, [])
+    expect(applySourceEdits(source, edits)).toBe(
+      'before\r\n```mdx\r\n<Panel />\r\n```\r\n',
+    )
+    expect(
+      buildMdxFenceDelimiterEdits(document, [{ start: 0, end: source.length }]),
+    ).toEqual([])
+  })
+
+  it('handles long nonmatching and matching whitespace runs before openers and closers', () => {
+    const whitespace = '\t'.repeat(100_000)
+    const source = `a${whitespace}\nbefore${whitespace}~~~mdx\na${whitespace}x\nafter${whitespace}~~~\t `
+    const expected = `a${whitespace}\nbefore\n~~~mdx\na${whitespace}x\nafter\n~~~`
+    expect(
+      applySourceEdits(
+        source,
+        buildMdxFenceDelimiterEdits(new SourceText(source), []),
+      ),
+    ).toBe(expected)
+  })
+})

packages/ts-format/src/fences.ts

@@ -324,15 +324,15 @@ function splitInlineMdxFenceDelimiters(source: string) {
 function splitLineBeforeInlineMdxFenceOpener(line: string) {
   if (parseMdxFenceDelimiter(line.trim())) return undefined
 
-  const match = /^(.+?)[\t ]*((?:`{3,}|~{3,}).*)$/.exec(line)
+  const match = /`{3}|~{3}/.exec(line)
   if (!match) return undefined
 
-  const before = match[1].trimEnd()
+  const before = line.slice(0, match.index).trimEnd()
   if (before.trim().length === 0) return undefined
 
   return {
     before,
-    fenceLine: match[2],
+    fenceLine: line.slice(match.index),
   }
 }
 
@@ -361,21 +361,18 @@ function splitLineBeforeInlineMdxFenceCloser(
   line: string,
   activeFence: MdxFence,
 ) {
-  const pattern = new RegExp(
-    `^(.*?)[\\t ]*(${escapeRegExp(activeFence.marker.repeat(activeFence.length))}${escapeRegExp(activeFence.marker)}*)[\\t ]*$`,
-  )
-  const match = pattern.exec(line)
-  if (!match || match[1].trim().length === 0) return undefined
+  let end = line.length
+  while (end > 0 && (line[end - 1] === '\t' || line[end - 1] === ' ')) end--
+  let start = end
+  while (start > 0 && line[start - 1] === activeFence.marker) start--
+  if (end - start < activeFence.length) return undefined
 
-  const closingDelimiter = parseMdxFenceDelimiter(match[2].trim())
-  if (!closingDelimiter) return undefined
-  if (!isMdxFenceClosingDelimiter(closingDelimiter, activeFence)) {
-    return undefined
-  }
+  const before = line.slice(0, start).trimEnd()
+  if (before.trim().length === 0) return undefined
 
   return {
-    before: match[1].trimEnd(),
-    fenceLine: match[2],
+    before,
+    fenceLine: line.slice(start, end),
   }
 }
 

packages/ts-format/src/html.test.ts

@@ -1,5 +1,8 @@
 import { describe, expect, it } from 'vitest'
-import { normalizeClosingTagSpacing } from './html'
+import {
+  normalizeClosingTagSpacing,
+  normalizeSelfClosingTagSpacing,
+} from './html'
 import { formatSource } from './index'
 
 describe('closing tag formatting', () => {
@@ -46,3 +49,30 @@ describe('closing tag formatting', () => {
     )
   })
 })
+
+describe('self-closing tag spacing', () => {
+  it.each([' ', '\t', '\n', '\r\n', '\u00a0', '\u2028', '\u2029', '\ufeff'])(
+    'removes whitespace before /> and preserves other whitespace (%j)',
+    (whitespace) => {
+      const source = `before${whitespace}<Panel${whitespace}/>${whitespace}after`
+      expect(normalizeSelfClosingTagSpacing(source)).toBe(
+        `before${whitespace}<Panel/>${whitespace}after`,
+      )
+    },
+  )
+
+  it('normalizes multiple tags and mixed whitespace without consuming a bare slash', () => {
+    const source = '<Panel \t\r\n/><img/><Icon  /> / > <Other \t/>'
+    const formatted = '<Panel/><img/><Icon/> / > <Other/>'
+    expect(normalizeSelfClosingTagSpacing(source)).toBe(formatted)
+    expect(normalizeSelfClosingTagSpacing(formatted)).toBe(formatted)
+  })
+
+  it('handles long whitespace runs with and without a following self-closing delimiter', () => {
+    const whitespace = ' \t'.repeat(50_000)
+    const source = `${whitespace}text${whitespace}/x${whitespace}/>`
+    expect(normalizeSelfClosingTagSpacing(source)).toBe(
+      `${whitespace}text${whitespace}/x/>`,
+    )
+  })
+})

packages/ts-format/src/html.ts

@@ -56,5 +56,8 @@ export function getLineIndent(line: string) {
 }
 
 export function normalizeSelfClosingTagSpacing(formatted: string) {
-  return formatted.replace(/\s+\/>/g, '/>')
+  // Match each whitespace run once, even when no /> follows it.
+  return formatted.replace(/\s+/g, (whitespace, offset: number) =>
+    formatted.startsWith('/>', offset + whitespace.length) ? '' : whitespace,
+  )
 }