Clusterfuzz found another way (go-gitea#15160)

Backport go-gitea#15160 Clusterfuzz found another way so I found another way to stop it Signed-off-by: Andrew Thornton <[email protected]>
zeripath · Mar 26, 2021 · 1addfc7 · 1addfc7
1 parent 3558310
commit 1addfc7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/modules/markup/html.go b/modules/markup/html.go
@@ -313,7 +313,7 @@ func RenderEmoji(
 	return ctx.postProcess(rawHTML)
 }
 
-var tagCleaner = regexp.MustCompile(`<((?:/?\w+/\w+)|(?:/[\w ]+/)|(/?[hH][tT][mM][lL][ />])|(/?[hH][eE][aA][dD][ />]))`)
+var tagCleaner = regexp.MustCompile(`<((?:/?\w+/\w+)|(?:/[\w ]+/)|(/?[hH][tT][mM][lL]\b)|(/?[hH][eE][aA][dD]\b))`)
 var nulCleaner = strings.NewReplacer("\000", "")
 
 func (ctx *postProcessCtx) postProcess(rawHTML []byte) ([]byte, error) {