mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
fb6b354fbd
Replace the lazy quantifier (.+?) with a negated character class ([^\s*]+) that excludes whitespace and asterisks. Source map URLs never contain these characters, so the fix is semantically equivalent while eliminating the O(n²) backtracking path triggered by unclosed /*# sourceMappingURL= fragments. Fixes: polynomial ReDoS in addBaseHrefToCssSourceMap