Clusterfuzz found another way (#15160) (#15169)

zeripath · web-flow · commit 8d4f8ebf3105 · 2021-03-27T01:53:51.000+02:00
Backport #15160 Clusterfuzz found another way so I found another way to stop it Signed-off-by: Andrew Thornton <art27@cantab.net>
diff --git a/modules/markup/html.go b/modules/markup/html.go
@@ -298,7 +298,7 @@ func RenderEmoji(
 	return ctx.postProcess(rawHTML)
 }
 
-var tagCleaner = regexp.MustCompile(`<((?:/?\w+/\w+)|(?:/[\w ]+/)|(/?[hH][tT][mM][lL][ />])|(/?[hH][eE][aA][dD][ />]))`)
+var tagCleaner = regexp.MustCompile(`<((?:/?\w+/\w+)|(?:/[\w ]+/)|(/?[hH][tT][mM][lL]\b)|(/?[hH][eE][aA][dD]\b))`)
 var nulCleaner = strings.NewReplacer("\000", "")
 
 func (ctx *postProcessCtx) postProcess(rawHTML []byte) ([]byte, error) {

Original file line number	Diff line number	Diff line change
`@@ -298,7 +298,7 @@ func RenderEmoji(`
`298`	`298`	`return ctx.postProcess(rawHTML)`
`299`	`299`	`}`
`300`	`300`
`301`		-var tagCleaner = regexp.MustCompile(`<((?:/?\w+/\w+)\|(?:/[\w ]+/)\|(/?[hH][tT][mM][lL][ />])\|(/?[hH][eE][aA][dD][ />]))`)
	`301`	+var tagCleaner = regexp.MustCompile(`<((?:/?\w+/\w+)\|(?:/[\w ]+/)\|(/?[hH][tT][mM][lL]\b)\|(/?[hH][eE][aA][dD]\b))`)
`302`	`302`	`var nulCleaner = strings.NewReplacer("\000", "")`
`303`	`303`
`304`	`304`	`func (ctx *postProcessCtx) postProcess(rawHTML []byte) ([]byte, error) {`