ah, bluhm already committed it.
On 2026/07/08 12:07, Stuart Henderson wrote:
> ok to update?
>
> "The trim and rtrim functions stripped trailing whitespace with
> s/\s*$//u. Because \s* matches greedily and the $ anchor fails whenever
> a non-whitespace character follows the whitespace, the regex engine
> retries the match at each offset of a long whitespace run, producing
> quadratic backtracking. The fix replaces \s*$ with \s+$.
>
> Any caller that passes untrusted input to trim or rtrim can trigger CPU
> exhaustion with a string containing a long run of whitespace."
>
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/textproc/p5-String-Util/Makefile,v
> diff -u -p -r1.2 Makefile
> --- Makefile 5 Sep 2024 02:53:43 -0000 1.2
> +++ Makefile 8 Jul 2026 11:07:09 -0000
> @@ -1,6 +1,7 @@
> COMMENT = string processing utility functions
>
> -DISTNAME = String-Util-1.35
> +CPAN_AUTHOR = BAKERSCOT
> +DISTNAME = String-Util-1.36
>
> CATEGORIES = textproc
>
> Index: distinfo
> ===================================================================
> RCS file: /cvs/ports/textproc/p5-String-Util/distinfo,v
> diff -u -p -r1.2 distinfo
> --- distinfo 5 Sep 2024 02:53:43 -0000 1.2
> +++ distinfo 8 Jul 2026 11:07:09 -0000
> @@ -1,2 +1,2 @@
> -SHA256 (String-Util-1.35.tar.gz) =
> 4IncSqcUxIAbNZ32VG8mW605LKI4AwnIkA5FtGaLt24=
> -SIZE (String-Util-1.35.tar.gz) = 17216
> +SHA256 (String-Util-1.36.tar.gz) =
> UXsasyVm/U1ei+I9mTOc47/+4pEsX/KfXclYcP9Pyw4=
> +SIZE (String-Util-1.36.tar.gz) = 19204
>
