{"action":"created","issue":{"url":"https://api.github.com/repos/rails/rails/issues/21136","labels_url":"https://api.github.com/repos/rails/rails/issues/21136/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/21136/comments","events_url":"https://api.github.com/repos/rails/rails/issues/21136/events","html_url":"https://github.com/rails/rails/issues/21136","id":99367779,"number":21136,"title":"complex css cause sanitize to take forever","user":{"login":"mfazekas","id":52435,"avatar_url":"https://avatars.githubusercontent.com/u/52435?v=3","gravatar_id":"","url":"https://api.github.com/users/mfazekas","html_url":"https://github.com/mfazekas","followers_url":"https://api.github.com/users/mfazekas/followers","following_url":"https://api.github.com/users/mfazekas/following{/other_user}","gists_url":"https://api.github.com/users/mfazekas/gists{/gist_id}","starred_url":"https://api.github.com/users/mfazekas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mfazekas/subscriptions","organizations_url":"https://api.github.com/users/mfazekas/orgs","repos_url":"https://api.github.com/users/mfazekas/repos","events_url":"https://api.github.com/users/mfazekas/events{/privacy}","received_events_url":"https://api.github.com/users/mfazekas/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-06T06:30:51Z","updated_at":"2015-08-08T07:31:39Z","closed_at":null,"body":"```ruby\r\n  def test_returns_success\r\n    complex_inline_style = \"some-attribute: 10px 10px 10px 10px !important; \"*40+\"background-image: -webkit-linear-gradient(top, rgb(254, 254, 254) 0%, rgb(236, 236, 236) 100%) !important;\"\r\n    html = \"<div style=\\\"#{complex_inline_style}\\\"></div>\"\r\n\r\n    sanitize html\r\n  end\r\n```\r\n[full test](https://gist.github.com/mfazekas/197b133755e8d21a1317)\r\n\r\nsee also https://github.com/rails/rails-html-sanitizer/issues/41\r\n\r\n```ruby\r\ngem 'rails-deprecated_sanitizer'\r\n```\r\nworks around the issue for us"},"comment":{"url":"https://api.github.com/repos/rails/rails/issues/comments/128926494","html_url":"https://github.com/rails/rails/issues/21136#issuecomment-128926494","issue_url":"https://api.github.com/repos/rails/rails/issues/21136","id":128926494,"user":{"login":"claudiob","id":10076,"avatar_url":"https://avatars.githubusercontent.com/u/10076?v=3","gravatar_id":"","url":"https://api.github.com/users/claudiob","html_url":"https://github.com/claudiob","followers_url":"https://api.github.com/users/claudiob/followers","following_url":"https://api.github.com/users/claudiob/following{/other_user}","gists_url":"https://api.github.com/users/claudiob/gists{/gist_id}","starred_url":"https://api.github.com/users/claudiob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/claudiob/subscriptions","organizations_url":"https://api.github.com/users/claudiob/orgs","repos_url":"https://api.github.com/users/claudiob/repos","events_url":"https://api.github.com/users/claudiob/events{/privacy}","received_events_url":"https://api.github.com/users/claudiob/received_events","type":"User","site_admin":false},"created_at":"2015-08-08T07:31:39Z","updated_at":"2015-08-08T07:31:39Z","body":"@mfazekas I was able to reproduce the error. \r\n\r\nIt’s caused [by this regex](https://github.com/flavorjones/loofah/blob/master/lib/loofah/html5/scrub.rb#L70) in the loofah codebase:\r\n\r\n```ruby\r\nreturn '' unless style =~ /\\A([-:,;#%.\\sa-zA-Z0-9!]|\\w-\\w|\\'[\\s\\w]+\\'|\\\"[\\s\\w]+\\\"|\\([\\d,\\s]+\\))*\\z/\r\n```\r\n\r\nIt looks like Ruby gets stuck when trying to parse your string against that regular expression.\r\n\r\nIn fact, to reproduce the error, you don’t even need to install Rails or Loofah, simply open a Ruby session and type the following:\r\n\r\n```ruby\r\ncomplex_inline_style = \"some-attribute: 10px 10px 10px 10px !important; \"*40+\"background-image: -webkit-linear-gradient(top, rgb(254, 254, 254) 0%, rgb(236, 236, 236) 100%) !important;\"\r\ncomplex_inline_style =~ /\\A([-:,;#%.\\sa-zA-Z0-9!]|\\w-\\w|\\'[\\s\\w]+\\'|\\\"[\\s\\w]+\\\"|\\([\\d,\\s]+\\))*\\z/\r\n```\r\n\r\nMaybe @flavorjones or @kaspth who worked on that regular expression might have a better idea about the reason why.\r\n"}}