Zend Framework

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.10.7
• Fix Version/s: 1.11.0
• Component/s: Zend_Filter
• Labels:

  None

line[243]

// Strip HTML comments first
        while (strpos($value, '<!--') !== false) {
            $pos   = strrpos($value, '<!--');
            $start = substr($value, 0, $pos);
            $value = substr($value, $pos);
            $value = preg_replace('/<(?:!(?:--[\s\S]*?--\s*)?(>))/s', '',  $value);
            $value = $start . $value;
        }

if you try to filter string "<!---" then filter falls into infinite loop

$filter = Zend_Filter_StripTags();
$filter->filter('<!------- text');

1. 

   ZF-10256.patch

   06/Aug/10 12:31 AM

   2 kB

   Piotr Mlocek

• Assignee:

  Thomas Weidner

  Reporter:

  Mokevnin Kirill

• Created:

  03/Aug/10 3:10 AM

  Updated:

  08/Aug/10 1:32 AM

  Resolved:

  08/Aug/10 1:32 AM