Skip to content

Markup: match comments containing a nested "<!--" - #4103

Closed
spokodev wants to merge 1 commit into
PrismJS:v2from
spokodev:fix/markup-nested-comment-marker
Closed

spokodev wants to merge 1 commit into
PrismJS:v2from
spokodev:fix/markup-nested-comment-marker

Conversation

@spokodev

@spokodev spokodev commented Sep 2, 2026

Copy link
Copy Markdown

Prism's comment rule for markup uses /<!--(?:(?!<!--)[\s\S])*?-->/, which refuses to match once it encounters a second <!-- inside the comment body. Per the HTML tokenizer (WHATWG §13.2.5 comment states), a comment ends at the first -->; an embedded <!-- has no special meaning and is just content.

So <!-- foo <!-- bar --> — commented-out markup that itself contains a comment marker — fails to tokenize as a comment and falls through to the tag rule, which mis-highlights the whole thing as a bogus HTML tag. Dropping the (?!<!--) guard matches the comment as a single token, in line with the spec. Added a test case.

@netlify

netlify Bot commented Sep 2, 2026

Copy link
Copy Markdown

Deploy Preview for dev-prismjs-com ready!

Name Link
🔨 Latest commit 40ce41f
🔍 Latest deploy log https://app.netlify.com/projects/dev-prismjs-com/deploys/6a98b314799bcb0008bf4ac6
😎 Deploy Preview https://deploy-preview-4103--dev-prismjs-com.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown

No JS Changes

Generated by 🚫 dangerJS against 40ce41f

@jonpyt

jonpyt commented Sep 6, 2026

Copy link
Copy Markdown

Ignoring comments containing <!-- is done for performance reasons. The pattern /<!--[\s\S]*?-->/ is vulnerable to ReDoS. See #3078 and GHSA-727m-83cp-w8cj.

@spokodev

spokodev commented Sep 7, 2026

Copy link
Copy Markdown
Author

You are right, and I should have checked before opening this. The lookahead is doing real work — it bounds how far each match attempt can scan, so removing it makes the pattern quadratic.

Measured on Node 24, input "<!--".repeat(n) (many starts, no -->):

n <!--(?:(?!<!--)[\s\S])*?--> <!--[\s\S]*?-->
4000 0.0 ms 10.9 ms
8000 0.0 ms 44.4 ms
16000 0.1 ms 177.8 ms
32000 0.1 ms 721.1 ms

Four times the work per doubling, so the current guard is the thing keeping this linear. The divergence from the HTML tokenizer on a nested <!-- is a deliberate trade-off, not an oversight.

Closing.

@spokodev spokodev closed this Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants