Skip to content

Conversation

@ericcornelissen
Copy link

Improve input string that are pathological by virtue of containing lots of whitespace but not at the end or start of the string. Such strings can lead to quadratic runtime of the regular expression present in the ToNumber implementation, unnecessarily consuming computational resources.

This patches addresses the problem by ensuring that the string does end with a whitespace character before removing whitespace character from the end of the string. This ensures that pathological inputs cannot cause quadratic runtime because such inputs won't reach the regular expression.

An alternative solution would be to have a negative lookbehind in the regular expression. But, following related patches in related projects (es-shims/String.prototype.trim#13 and es-shims/String.prototype.trimEnd#6) I opted for the above solution.

Improve input string that are pathological by virtue
of containing lots of whitespace but not at the end
or start of the string. Such strings can lead to
quadratic runtime of the regular expression present
in the `ToNumber` implementation, unnecessarily
consuming computational resources.

This patches addresses the problem by ensuring that
the string does end with a whitespace character
before removing whitespace character from the end of
the string. This ensures that pathological inputs
cannot cause quadratic runtime because such inputs
won't reach the regular expression.

An alternative solution would be to have a negative
lookbehind in the regular expression. But, following
related patches in related projects I opted for the
above solution.
@ljharb
Copy link
Member

ljharb commented Nov 16, 2025

If there's no regression test I'm not sure it's worth fixing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants