Merge commit from fork

.changeset/proud-dogs-go.md

@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: harden regex

packages/svelte/src/utils.js

@@ -491,7 +491,7 @@ export function is_raw_text_element(name) {
 // Rejects strings containing whitespace, quotes, angle brackets, slashes, equals,
 // or other characters that could break out of a tag-name token and enable markup injection.
 export const REGEX_VALID_TAG_NAME =
-	/^[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9.\-_\u00B7\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u037D\u037F-\u1FFF\u200C-\u200D\u203F-\u2040\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\u{10000}-\u{EFFFF}]+)*$/u;
+	/^[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9.\-_\u00B7\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u037D\u037F-\u1FFF\u200C-\u200D\u203F-\u2040\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\u{10000}-\u{EFFFF}]*)?$/u;
 
 /**
  * Prevent devtools trying to make `location` a clickable link by inserting a zero-width space

packages/svelte/src/utils.test.ts

@@ -0,0 +1,50 @@
+import { expect, test } from 'vitest';
+import { REGEX_VALID_TAG_NAME } from './utils';
+
+test('REGEX_VALID_TAG_NAME accepts common HTML tag names', () => {
+	const common_html_tag_names = ['div', 'span', 'button', 'input', 'svg', 'math', 'a'];
+
+	for (const tag_name of common_html_tag_names) {
+		expect(REGEX_VALID_TAG_NAME.test(tag_name)).toBe(true);
+	}
+});
+
+test('REGEX_VALID_TAG_NAME accepts basic custom element names', () => {
+	const valid_custom_tag_names = ['my-element', 'x-foo', 'todo-item', 'my-element2'];
+
+	for (const tag_name of valid_custom_tag_names) {
+		expect(REGEX_VALID_TAG_NAME.test(tag_name)).toBe(true);
+	}
+});
+
+test('REGEX_VALID_TAG_NAME accepts spec-allowed custom element characters', () => {
+	const valid_custom_tag_names = [
+		'x-foo.bar',
+		'x-foo_bar',
+		'x-foo\u00B7bar',
+		'x-foo\u00FCbar',
+		'x-foo\u{1F600}bar',
+		'x-'
+	];
+
+	for (const tag_name of valid_custom_tag_names) {
+		expect(REGEX_VALID_TAG_NAME.test(tag_name)).toBe(true);
+	}
+});
+
+test('REGEX_VALID_TAG_NAME rejects invalid tag names', () => {
+	const invalid_tag_names = ['', '1', 'x\u00FC', '-x-foo', '1foo', 'x-foo bar', 'x-foo/', 'x-foo>'];
+
+	for (const tag_name of invalid_tag_names) {
+		expect(REGEX_VALID_TAG_NAME.test(tag_name)).toBe(false);
+	}
+});
+
+test('REGEX_VALID_TAG_NAME no ReDoS', () => {
+	const before = performance.now();
+	REGEX_VALID_TAG_NAME.test('a-----------------------------------!');
+	const after = performance.now();
+	if (after - before > 10) {
+		throw new Error(`REGEX_VALID_TAG_NAME is vulnerable to ReDoS`);
+	}
+});