From 4c90be6a30c55b2bc173252790be90ad32f83263 Mon Sep 17 00:00:00 2001
From: Thomas Fuchs <thomas@fesch.at>
Date: Tue, 3 Apr 2007 22:21:58 +0000
Subject: [PATCH] Prevent a crash on Safari on String.prototype.stripScripts
 and extractScripts with large <script> tags.

---
 CHANGELOG          |  2 ++
 src/prototype.js   |  2 +-
 test/unit/dom.html | 31 ++++++++++++++++++++++++++++---
 3 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 19f2cbd..9329130 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,7 @@
 *SVN*
 
+* Prevent a crash on Safari on String.prototyype.stripScripts and extractScripts with large <script> tags.  [Thomas Fuchs]
+
 * Prevent linefeed normalisation in String.prototype.escapeHTML and unescapeHTML on IE for consistency with other browsers. Speed optimizations for Safari and IE.  [Thomas Fuchs]
 
 * Make Hash.toQueryString serialize undefined values. Ensure consistency with String.prototype.toQueryParams.  Closes #7806.  [Mislav Marohnić]
diff --git a/src/prototype.js b/src/prototype.js
index 242cf30..c42c185 100644
--- a/src/prototype.js
+++ b/src/prototype.js
@@ -17,7 +17,7 @@ var Prototype = {
        document.createElement('form').__proto__)
   },
   
-  ScriptFragment: '(?:<script.*?>)((\n|\r|.)*?)(?:<\/script>)',
+  ScriptFragment: '<script[^>]*>([\u0001-\uFFFF]*?)</script>',
   emptyFunction: function() {},
   K: function(x) { return x }
 }
diff --git a/test/unit/dom.html b/test/unit/dom.html
index fcfe85e..fe006e5 100644
--- a/test/unit/dom.html
+++ b/test/unit/dom.html
@@ -270,7 +270,7 @@
 <script type="text/javascript" language="javascript" charset="utf-8">
 // <![CDATA[
 
-  var testVar = 'to be updated';
+  var testVar = 'to be updated', testVar2 = '';
 
   Element.addMethods("LI", {
     pancakes: function(element) { return "pancakes"; }
@@ -364,7 +364,7 @@
     }},
 
     testElementUpdateWithScript: function() {with(this) {
-      $('testdiv').update('hello from div!<script>testVar="hello!"</'+'script>');
+      $('testdiv').update('hello from div!<script>\ntestVar="hello!";\n</'+'script>');
       assertEqual('hello from div!',$('testdiv').innerHTML);
       wait(100,function(){
         assertEqual('hello!',testVar);
@@ -375,6 +375,18 @@
         assertMatch(/^another hello from div!\s+here it goes$/,$('testdiv').innerHTML);
         wait(100,function(){
           assertEqual('another hello!',testVar);
+          
+          Element.update('testdiv','a\n<script>testVar="a"\ntestVar="b"</'+'script>');
+          wait(100,function(){
+            assertEqual('b', testVar);
+            
+            Element.update('testdiv',
+              'x<script>testVar2="a"</'+'script>\nblah\n'+
+              'x<script>testVar2="b"</'+'script>');
+            wait(100,function(){
+              assertEqual('b', testVar2);
+            });
+          });
         });
       });
     }},
@@ -934,7 +946,20 @@
       assertRespondsTo('orangeJuice', elem2);
       assertEqual("orange juice", elem.orangeJuice());
       assertEqual("orange juice", elem2.orangeJuice());
-    }}    
+    }},
+    
+    testScriptFragment: function() {with(this) {
+      var element = document.createElement('div');
+      // tests an issue with Safari 2.0 crashing when the ScriptFragment
+      // regular expression is using a pipe-based approach for
+      // matching any character
+      ['\r','\n',' '].each(function(character){
+        $(element).update("<script>"+character.times(10000)+"</scr"+"ipt>");
+        assertEqual('', element.innerHTML);
+      });
+      $(element).update("<script>var blah='"+'\\'.times(10000)+"'</scr"+"ipt>");
+      assertEqual('', element.innerHTML);
+    }}
   }, 'testlog');
 
 // ]]>