Tighten up matching of bare words inside directives

Do not allow an unterminated """ string to be treated as a series of bare
words. Fixes runaway regexp recursion/backtracking in strange situations.

(See 1d57a21c987a5e970df01efe10acdf69982c2d61 for test case.)

diff --git a/IkiWiki.pm b/IkiWiki.pm
index 061a1c6db9f9560fb4b23766d975d4f76ccd5a45..d7c827c89b240d8d1b178be76934ce3c868ba4f8 100644 (file)
--- a/IkiWiki.pm
+++ b/IkiWiki.pm
@@ -1253,7 +1253,7 @@ sub preprocess ($$$;$$) {
                                                |
                                                "[^"]+"         # single-quoted value
                                                |
-                                               [^\s\]]+        # unquoted value
+                                               [^"\s\]]+       # unquoted value
                                        )
                                        \s*                     # whitespace or end
                                                                # of directive
@@ -1276,7 +1276,7 @@ sub preprocess ($$$;$$) {
                                                |
                                                "[^"]+"         # single-quoted value
                                                |
-                                               [^\s\]]+        # unquoted value
+                                               [^"\s\]]+       # unquoted value
                                        )
                                        \s*                     # whitespace or end
                                                                # of directive

diff --git a/debian/changelog b/debian/changelog
index be1db6f3c4b3ba6b681333913114eedbacd17b2a..bbc9b2c15cb6deae4f3c6bf3f95c1fa051c83c86 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,10 @@ ikiwiki (3.15) UNRELEASED; urgency=low
   * Avoid relying on translators preserving the case when translating
     "discussion", which caused Discussion pages to get unwanted Discussion
     links.
+  * Tighten up matching of bare words inside directives; do not
+    allow an unterminated """ string to be treated as a series
+    of bare words. Fixes runaway regexp recursion/backtracking
+    in strange situations.
 
  -- Joey Hess <joeyh@debian.org>  Tue, 02 Jun 2009 17:03:41 -0400