From 283b0f65c72e221fab25055ff0395548ea3aed50 Mon Sep 17 00:00:00 2001
From: Callum Loh <callumloh@gmail.com>
Date: Wed, 1 May 2024 13:11:50 +0100
Subject: [PATCH] fix: correctly locate and skip over esi:include tags with a
 blank src attribute

tags like <!-- bad ESI request: bad ESI request --> cause the parser to
skip over the tag and the following tag
---
 src/tagParser.ts |  4 ++--
 test/esi.spec.ts | 49 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/src/tagParser.ts b/src/tagParser.ts
index 242e8c0..86619ec 100644
--- a/src/tagParser.ts
+++ b/src/tagParser.ts
@@ -49,7 +49,7 @@ export class tagParser {
     }
 
     return new RegExp(
-      `<(${tag})(?:\\s*(?:[a-z]+=\\".+?(?<!\\\\)\\"))?[^>]*?(?:\\s*)(/>|>)?`,
+      `<(${tag})(?:\\s*(?:[a-z]+=\\".*?(?<!\\\\)\\"))?[^>]*?(?:\\s*)(/>|>)?`,
     );
   }
 
@@ -58,7 +58,7 @@ export class tagParser {
       return /(?:<(!--esi)|(-->))/;
     }
     return new RegExp(
-      `<[\\/]?(${tag})(?:\\s*(?:[a-z]+=\\".+?(?<!\\\\)\\"))?[^>]*?(?:\\s*)(\\s*/>|>)?`,
+      `<[\\/]?(${tag})(?:\\s*(?:[a-z]+=\\".*?(?<!\\\\)\\"))?[^>]*?(?:\\s*)(\\s*/>|>)?`,
     );
   }
 
diff --git a/test/esi.spec.ts b/test/esi.spec.ts
index f0d97c5..75f470c 100644
--- a/test/esi.spec.ts
+++ b/test/esi.spec.ts
@@ -1911,3 +1911,52 @@ test("TEST 50: Multiple ESI Args make it all the way through", async () => {
     `esi_args1=1&esi_args2=2&esi_args3=3&esi_args4=4`,
   );
 });
+
+test("TEST 51: Blank ESI source should be skipped over", async () => {
+  const url = `/esi/test-51`;
+  routeHandler.add(url, function (req, res) {
+    res.writeHead(200, esiHead);
+    res.say("START:");
+    res.say(`<!-- bad ESI request: bad ESI request -->`);
+    res.say(`<!-- bad ESI request: bad ESI request -->`);
+    res.say(`<!-- bad ESI request: bad ESI request -->`);
+    res.end(`:END`);
+  });
+  routeHandler.add(
+    `${url}/fragment_1`,
+    function (req, res) {
+      res.writeHead(200, esiHead);
+      res.end(`FRAGMENT`);
+    },
+    { count: 2 },
+  );
+  const res = await makeRequest(url);
+  expect(res.ok).toBeTruthy();
+  expect(checkSurrogate(res)).toBeTruthy();
+  expect(await res.text()).toEqual(
+    `START:\nFRAGMENT\n<!-- bad ESI request: bad ESI request -->\nFRAGMENT\n:END`,
+  );
+});
+
+test("TEST 52: ESI drops responses with no body", async () => {
+  const url = `/esi/test-52`;
+  routeHandler.add(url, function (req, res) {
+    res.writeHead(200, esiHead);
+    res.say("START:");
+    res.say(`<!-- bad ESI request: bad ESI request -->`);
+    res.end(`:END`);
+  });
+  routeHandler.add(
+    `${url}/fragment_1`,
+    function (req, res) {
+      res.writeHead(302, { Location: "http://localhost" });
+      res.end();
+    },
+    { count: 1 },
+  );
+  debugger;
+  const res = await makeRequest(url);
+  expect(res.ok).toBeTruthy();
+  expect(checkSurrogate(res)).toBeTruthy();
+  expect(await res.text()).toEqual(`START:\n\n:END`);
+});