From eaf69f591f8cf71319060c97da1aeddcd3a853cf Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Mon, 11 Aug 2025 00:52:09 +0200
Subject: SimplePie Fix regex backtrack limit in clean_hash() (#7813)

https://github.com/FreshRSS/simplepie/pull/48
and merge upstream https://github.com/FreshRSS/simplepie/pull/49
fix https://github.com/FreshRSS/FreshRSS/issues/7807
We had a risk of hitting `Backtrack limit was exhausted` in case of open XML comment `<!--` not closed and followed by a very long document.
Fixed by:
* Limiting the max length of the comment
* Stopping at an apparent end of CDATA section `]]>` as it is likely an error

It does not matter much if there are rare cases when the regex does not work perfectly, as it is only used for a cache hint.
---
 lib/composer.json                         |  2 +-
 lib/simplepie/simplepie/phpstan.dist.neon | 65 +++++++++++++++++++++++++++++++
 lib/simplepie/simplepie/phpstan.neon.dist | 65 -------------------------------
 lib/simplepie/simplepie/src/SimplePie.php |  2 +-
 4 files changed, 67 insertions(+), 67 deletions(-)
 create mode 100644 lib/simplepie/simplepie/phpstan.dist.neon
 delete mode 100644 lib/simplepie/simplepie/phpstan.neon.dist

diff --git a/lib/composer.json b/lib/composer.json
index 8c62f66ee..b0b4dd1cf 100644
--- a/lib/composer.json
+++ b/lib/composer.json
@@ -14,7 +14,7 @@
         "marienfressinaud/lib_opml": "0.5.1",
         "phpgt/cssxpath": "v1.3.0",
         "phpmailer/phpmailer": "6.10.0",
-        "simplepie/simplepie": "dev-freshrss#3cdee69fde431e6b461b87413177a791c2018098"
+        "simplepie/simplepie": "dev-freshrss#dcaa720d3d8bc8202333f569c4cddb4a407dc213"
     },
     "config": {
         "sort-packages": true,
diff --git a/lib/simplepie/simplepie/phpstan.dist.neon b/lib/simplepie/simplepie/phpstan.dist.neon
new file mode 100644
index 000000000..da1d19fc6
--- /dev/null
+++ b/lib/simplepie/simplepie/phpstan.dist.neon
@@ -0,0 +1,65 @@
+parameters:
+    level: 8
+
+    paths:
+        - library/
+        - src/
+        - tests/
+
+    ignoreErrors:
+        # Ignore that only one const exists atm
+        -
+            message: "#^Strict comparison using \\!\\=\\= between 'GET' and 'GET' will always evaluate to false\\.$#"
+            count: 1
+            path: src/HTTP/Psr18Client.php
+
+        # SimplePie\Content\Type\Sniffer::__construct(): Parameter $file could be mixed due to BC.
+        -
+            message: '(Result of \|\| is always false\.)'
+            count: 1
+            path: src/Content/Type/Sniffer.php
+
+        # Not used since https://github.com/simplepie/simplepie/commit/b2eb0134d53921e75f0fa70b1cf901ed82b988b1 but cannot be removed due to BC.
+        - '(Constructor of class SimplePie\\Enclosure has an unused parameter \$javascript\.)'
+
+        # Testing legacy dynamic property usage.
+        - '(Access to an undefined property SimplePie.IRI::\$nonexistent_prop\.)'
+
+        -
+            message: '(^Strict comparison using === between string and false will always evaluate to false\.$)'
+            count: 1
+            path: src/HTTP/Parser.php
+            # Only occurs on PHP ≥ 8.0
+            reportUnmatched: false
+
+        -
+            message: '(^Strict comparison using === between string and false will always evaluate to false\.$)'
+            count: 1
+            path: src/IRI.php
+            # Only occurs on PHP ≥ 8.0
+            reportUnmatched: false
+
+        -
+            message: '(^Parameter #1 \$exception of method PHPUnit\\Framework\\TestCase::expectException\(\) expects class-string<Throwable>, string given\.$)'
+
+            count: 3
+            path: tests/Unit/Cache/Psr16Test.php
+            # Only occurs on PHP ≤ 7.4
+            reportUnmatched: false
+
+        -
+            message: '(^Parameter \$parser of method SimplePie\\Parser::(tag_open|cdata|tag_close)\(\) has invalid type XMLParser\.$)'
+
+            count: 3
+            path: src/Parser.php
+            # Only occurs on PHP ≤ 7.4
+            reportUnmatched: false
+
+        # PHPStan stubs bug https://github.com/phpstan/phpstan/issues/8629
+        -
+            message: '(^Access to an undefined property XMLReader::\$\w+\.$)'
+            # Only occurs on PHP ≥ 8.2
+            reportUnmatched: false
+
+includes:
+    - utils/PHPStan/extension.neon
diff --git a/lib/simplepie/simplepie/phpstan.neon.dist b/lib/simplepie/simplepie/phpstan.neon.dist
deleted file mode 100644
index da1d19fc6..000000000
--- a/lib/simplepie/simplepie/phpstan.neon.dist
+++ /dev/null
@@ -1,65 +0,0 @@
-parameters:
-    level: 8
-
-    paths:
-        - library/
-        - src/
-        - tests/
-
-    ignoreErrors:
-        # Ignore that only one const exists atm
-        -
-            message: "#^Strict comparison using \\!\\=\\= between 'GET' and 'GET' will always evaluate to false\\.$#"
-            count: 1
-            path: src/HTTP/Psr18Client.php
-
-        # SimplePie\Content\Type\Sniffer::__construct(): Parameter $file could be mixed due to BC.
-        -
-            message: '(Result of \|\| is always false\.)'
-            count: 1
-            path: src/Content/Type/Sniffer.php
-
-        # Not used since https://github.com/simplepie/simplepie/commit/b2eb0134d53921e75f0fa70b1cf901ed82b988b1 but cannot be removed due to BC.
-        - '(Constructor of class SimplePie\\Enclosure has an unused parameter \$javascript\.)'
-
-        # Testing legacy dynamic property usage.
-        - '(Access to an undefined property SimplePie.IRI::\$nonexistent_prop\.)'
-
-        -
-            message: '(^Strict comparison using === between string and false will always evaluate to false\.$)'
-            count: 1
-            path: src/HTTP/Parser.php
-            # Only occurs on PHP ≥ 8.0
-            reportUnmatched: false
-
-        -
-            message: '(^Strict comparison using === between string and false will always evaluate to false\.$)'
-            count: 1
-            path: src/IRI.php
-            # Only occurs on PHP ≥ 8.0
-            reportUnmatched: false
-
-        -
-            message: '(^Parameter #1 \$exception of method PHPUnit\\Framework\\TestCase::expectException\(\) expects class-string<Throwable>, string given\.$)'
-
-            count: 3
-            path: tests/Unit/Cache/Psr16Test.php
-            # Only occurs on PHP ≤ 7.4
-            reportUnmatched: false
-
-        -
-            message: '(^Parameter \$parser of method SimplePie\\Parser::(tag_open|cdata|tag_close)\(\) has invalid type XMLParser\.$)'
-
-            count: 3
-            path: src/Parser.php
-            # Only occurs on PHP ≤ 7.4
-            reportUnmatched: false
-
-        # PHPStan stubs bug https://github.com/phpstan/phpstan/issues/8629
-        -
-            message: '(^Access to an undefined property XMLReader::\$\w+\.$)'
-            # Only occurs on PHP ≥ 8.2
-            reportUnmatched: false
-
-includes:
-    - utils/PHPStan/extension.neon
diff --git a/lib/simplepie/simplepie/src/SimplePie.php b/lib/simplepie/simplepie/src/SimplePie.php
index b351b1215..47886305b 100644
--- a/lib/simplepie/simplepie/src/SimplePie.php
+++ b/lib/simplepie/simplepie/src/SimplePie.php
@@ -1695,7 +1695,7 @@ class SimplePie
                         [
                             '#<(lastBuildDate|pubDate|updated|feedDate|dc:date|slash:comments)>[^<]+</\\1>#',
                             '#<(media:starRating|media:statistics) [^/<>]+/>#',
-                            '#<!--.+?-->#s',
+                            '#<!--.{,8192}?(-->|(?=]]>))#s', // XML comments up to a max length and stops at apparent end of CDATA section
                         ],
                         '',
                         $stream_data
-- 
cgit v1.2.3