Description

I am writing to report a potential Regular Expression Denial of Service (ReDoS) vulnerability or Inefficient Regular Expression in the project. When using specially crafted input strings in the context, it may lead to extremely high CPU usage, application freezing, or denial of service attacks.

gist:https://gist.github.com/mmmsssttt404/2115fe1bbc0afdecda2128d5084b18a0

1.git clone https://github.com/mmmsssttt404/video.js.git
2.cd video.js
3.npm install
4.npx qunit test/build/jsdoc-typeof-plugin.test.js
5.npm test

Specific Changes proposed

Please list the specific changes involved in this pull request.

change regex to:
https://github.com/mmmsssttt404/video.js/blob/d9ae655a3710d42adeb7e7be31fe316515ccf801/build/jsdoc-typeof-plugin.js#L6

then:

Requirements Checklist

• Feature implemented / Bug fixed
• If necessary, more likely in a feature request than a bug fix
  • Change has been verified in an actual browser (Chrome, Firefox, IE)
  • Unit Tests updated or fixed
  • Docs/guides updated
  • Example created (starter template on JSBin)
  • Has no DOM changes which impact accessiblilty or trigger warnings (e.g. Chrome issues tab)
  • Has no changes to JSDoc which cause npm run docs:api to error
• Reviewed by Two Core Contributors