mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 05:26:47 +00:00
Maurice
071f516c0f
Two passes over the ReDoS findings arrived at the same scanner independently — one replacing `/<[^>]+>/g` in the KML importer and the Commons metadata helper, the other in the mail/HTML text extractor. The algorithm is the same down to the edge cases, so the extractor now imports common/stripHtmlTags rather than carrying its own. Checked before folding them together rather than assumed: the two implementations were compared over 2,441,406 generated strings and agree on every one. The shared helper takes the replacement string as a parameter, which is the only thing that differed — the extractor substitutes a space, the KML importer nothing. Two cases the shared helper's own test covers only in the abstract get a concrete one here, since this is where the input is a file somebody uploaded: an empty `<>` stays literal, and a `<` inside a tag is content, so `3 < 4 and <b>5</b>` strips to `3 5` rather than keeping the first bracket. Both are the old regex's behaviour, which is the point.