zendframework / zend-filter

Filter component from Zend Framework
BSD 3-Clause "New" or "Revised" License
68 stars 35 forks source link

StripTags infinite loop on malformed comments #88

Closed TotalWipeOut closed 5 years ago

TotalWipeOut commented 5 years ago

While attempting to get the text content of an HTML string, I found that users had pasted in code that contained these short HTML comments, <!--> and <!--->`.

Code to reproduce the issue

<?php

require 'vendor/autoload.php';

$stripTags = new Zend\Filter\StripTags();

$html = 'This <!-- --> works';
$text = $stripTags->filter($html);
echo $text . PHP_EOL;

$html = 'infinite<!--> loop';
$text = $stripTags->filter($html);

$html = 'also infinite<!---> loop';
$text = $stripTags->filter($html);

Expected results

These short comment artefacts should be removed like any other HTML comment

Actual results

These caused infinite loops. I see these artefacts as something that StripTags should remove.