Infinite regexp execution in prune scrubber

[jordoh]

Here's a failing test for a CSS style that causes scrub! :prune to get stuck executing the regexp on line 70 of lib/loofah/html5/scrub.rb. For the test I've added a 60 second timeout - so it actually finishes - in the wild I've had processes stuck here for 10+ hours before I killed them.

[jordoh]

Some additional information:

This appears to be due to the dash character added in ca618fc to allow negative values.

The following never completes (ruby 2.1.1):

> 'mso-effects-reflection-anglekx: 0; mso-effects-reflection-angleky: 0; mso-effects-reflection-pctalphastart: 28.0%; mso-effects-reflection-pctstartpos: 0%; mso-effects-reflection-pctalphaend: 0%; mso-effects-reflection-pctendpos: 45.0%; mso-effects-reflection-angfadedirection: 5400000; mso-effects-reflection-align: bottomleft; mso-style-textoutline-fill-colortransforms: \"shade=50000 satm=120000\"; mso-style-textfill-type: gradient; mso-style-textfill-fill-gradientfill-shadetype: linear; mso-style-textfill-fill-gradientfill-shade-linearshade-angle: 5400000; mso-style-textfill-fill-gradientfill-shade-linearshade-fscaled: no;' =~ /\A([-:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*\z/

While the following (single - character removed from regexp) completes:

> 'mso-effects-reflection-anglekx: 0; mso-effects-reflection-angleky: 0; mso-effects-reflection-pctalphastart: 28.0%; mso-effects-reflection-pctstartpos: 0%; mso-effects-reflection-pctalphaend: 0%; mso-effects-reflection-pctendpos: 45.0%; mso-effects-reflection-angfadedirection: 5400000; mso-effects-reflection-align: bottomleft; mso-style-textoutline-fill-colortransforms: \"shade=50000 satm=120000\"; mso-style-textfill-type: gradient; mso-style-textfill-fill-gradientfill-shadetype: linear; mso-style-textfill-fill-gradientfill-shade-linearshade-angle: 5400000; mso-style-textfill-fill-gradientfill-shade-linearshade-fscaled: no;' =~ /\A([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*\z/
nil

[flavorjones]

Thanks for submitting this. I need to dig in deeper to fully understand what's going on, and I don't have the time right now, so this won't be fixed in v2.0.2 which I'm about to release.

[mfazekas]

Same as #90

[flavorjones]

Hi, please check out #90 and #91 for work I've done towards fixing this issue. I apologize for not merging your pull request, but I am very grateful for the work you put forward in providing a reproducible test case. Thank you so much!