Fix ReDoS in previous-map

Fix Strategy: Replace `(.*)` with `(?:(?!sourceMappingURL=).)*`
postcss · Apr 26, 2021 · 2ad1ca9 · 2ad1ca9 · rmkanda · May 13, 2021
1 parent dc6cff1
commit 2ad1ca9
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/lib/previous-map.js b/lib/previous-map.js
@@ -48,11 +48,11 @@ class PreviousMap {
   }
 
   getAnnotationURL(sourceMapString) {
-    return sourceMapString.match(/\/\*\s*# sourceMappingURL=(.*)\*\//)[1].trim()
+    return sourceMapString.match(/\/\*\s*# sourceMappingURL=((?:(?!sourceMappingURL=).)*)\*\//)[1].trim()
   }
 
   loadAnnotation(css) {
-    let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\*\//gm)
+    let annotations = css.match(/\/\*\s*# sourceMappingURL=(?:(?!sourceMappingURL=).)*\*\//gm)
 
     if (annotations && annotations.length > 0) {
       // Locate the last sourceMappingURL to avoid picking up