Backport ReDoS vulnerabilities from PostCSS 8

ai · ai · commit 54cbf3c4847e · 2021-06-10T22:38:48.000-04:00
diff --git a/lib/previous-map.es6 b/lib/previous-map.es6
@@ -73,12 +73,14 @@ class PreviousMap {
 
   getAnnotationURL (sourceMapString) {
     return sourceMapString
-      .match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//)[1]
+      .match(/\/\*\s*# sourceMappingURL=((?:(?!sourceMappingURL=).)*)\*\//)[1]
       .trim()
   }
 
   loadAnnotation (css) {
-    let annotations = css.match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//mg)
+    let annotations = css.match(
+      /\/\*\s*# sourceMappingURL=(?:(?!sourceMappingURL=).)*\*\//gm
+    )
 
     if (annotations && annotations.length > 0) {
       // Locate the last sourceMappingURL to avoid picking up
