GHSA-m7fp-h3p4-hr49 LiquidJS has an infinite loop vulnerability in its `strip_html` filter

• npm liquidjs: >= 10.26.0, < 10.27.1 → fixed in 10.27.1

Summary The current implementation of `strip_html` can cause an infinite loop when the input string contains `` appears after `' as the catch-all kind; a regex // equivalent is O(n^2) in V8 on unclosed openers. export function strip_html (this: FilterImpl, v: string) { const str = stringify(v) this.context.memoryLimit.use(str.length) const blocks = new Map([[''], [''], [''], ['']]) let out = '' let i = 0 while (i = 0) { i = e + closer.length; break } blocks.delete(opener) } if (i === lt) return out + str.slice(lt) } return out } ``` For the input "a after <. Therefore, when execution reaches `if (i === lt) return out + str.slice(lt)`, `i` is 0. This is the same state as at the beginning of the loop. As a result, the same thing is repeated again from that state, causing an infinite loop. PoC ``` const { Liquid } = require('liquidjs'); const engine = new Liquid(); engine.parseAndRender('{{ html | strip_html }}', { html: 'a<' }).then(console.log); console.log("This is never displayed."); ``` Impact This is an infinite loop vulnerability (cf. https://cwe.mitre.org/data/definitions/835.html). This results in a denial of service (DoS). Although a ReDoS vulnerability has previously been reported in the affected function (cf. https://github.com/harttle/liquidjs/security/advisories/GHSA-r7g9-xpmj-5fcq), this issue can cause a more severe impact than that ReDoS vulnerability with an input of only two characters at minimum. Recommended Fix There is an issue with the following conditional branch. ``` if (i === lt) return out + str.slice(lt); ``` The following should fix the issue. ``` if (i <= lt) return out + str.slice(lt); ```