From: zeripath <art27@cantab.net>
Date: Thu, 25 Mar 2021 23:21:00 +0000 (+0000)
Subject: Clusterfuzz found another way (#15160)
X-Git-Tag: v1.15.0-rc1~566
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=b68eb54f95f894a71a1a91c22eff90e1d2f38a0e;p=gitea.git

Clusterfuzz found another way (#15160)

Clusterfuzz found another way so I found another way to stop it

Signed-off-by: Andrew Thornton <art27@cantab.net>
---

diff --git a/modules/markup/html.go b/modules/markup/html.go
index 2ea0b56f72..bec9ba2fb4 100644
--- a/modules/markup/html.go
+++ b/modules/markup/html.go
@@ -313,7 +313,7 @@ func RenderEmoji(
 	return ctx.postProcess(rawHTML)
 }
 
-var tagCleaner = regexp.MustCompile(`<((?:/?\w+/\w+)|(?:/[\w ]+/)|(/?[hH][tT][mM][lL][ />])|(/?[hH][eE][aA][dD][ />]))`)
+var tagCleaner = regexp.MustCompile(`<((?:/?\w+/\w+)|(?:/[\w ]+/)|(/?[hH][tT][mM][lL]\b)|(/?[hH][eE][aA][dD]\b))`)
 var nulCleaner = strings.NewReplacer("\000", "")
 
 func (ctx *postProcessCtx) postProcess(rawHTML []byte) ([]byte, error) {