GHSA-r7g9-xpmj-5fcq LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

• npm liquidjs: < 10.26.0 → fixed in 10.26.0

Summary The built-in `strip_html` filter in liquidjs uses a regex containing four lazy-quantified alternatives. When the input contains many `|||/g, '') } ``` The regex contains four lazy patterns: 1. `` 2. `` 3. `` 4. `` For an input like `' { for (const n of [1000, 2000, 4000, 8000, 16000]) { const payload = ' { const payload = ')[^|)[^|)[^-]*)*-->|]*>/g, '' ) ``` This unrolls each lazy quantifier so each ``, ``, comment, or generic tag, and emit nothing for those ranges. Either fix should be combined with charging the regex output cost honestly to `memoryLimit` and (defensively) capping input length up front: ```ts export function strip_html (this: FilterImpl, v: string) { const str = stringify(v) this.context.memoryLimit.use(str.length) // ... linear-time strip implementation here } ```