Workaround is to increase pcre.backtrack_limit. However, I think it would be better if the error handling in this function is improved to account for when preg_replace_callback returns null. I expect that it would just skip that comment regex functionality in that case.
The comment regex in https://github.com/xemlock/htmlpurifier-html5/blob/master/library/HTMLPurifier/Lexer/HTML5.php#L57 can cause catastrophic back tracking. The result is
preg_replace_callback
returnsnull
Workaround is to increase
pcre.backtrack_limit
. However, I think it would be better if the error handling in this function is improved to account for whenpreg_replace_callback
returnsnull
. I expect that it would just skip that comment regex functionality in that case.