Block Editor: Update @WordPress package dependencies.

Updated packages

 - @wordpress/block-library@2.2.9
 - @wordpress/block-serialization-default-parser@2.0.1
 - @wordpress/block-serialization-spec-parser@2.0.1
 - @wordpress/blocks@6.0.3
 - @wordpress/edit-post@3.1.4
 - @wordpress/editor@9.0.4
 - @wordpress/format-library@1.2.7

Other changes:

 - Backport the parser changes.

Fixes #45145.


git-svn-id: https://develop.svn.wordpress.org/branches/5.0@43955 602fd350-edb4-49c9-b593-d223f7449a82

package.json

@@ -55,9 +55,9 @@
 		"@wordpress/api-fetch": "^2.2.5",
 		"@wordpress/autop": "^2.0.2",
 		"@wordpress/blob": "^2.1.0",
-		"@wordpress/block-library": "^2.2.8",
-		"@wordpress/block-serialization-default-parser": "^2.0.0",
-		"@wordpress/blocks": "^6.0.2",
+		"@wordpress/block-library": "^2.2.9",
+		"@wordpress/block-serialization-default-parser": "^2.0.1",
+		"@wordpress/blocks": "^6.0.3",
 		"@wordpress/components": "^7.0.3",
 		"@wordpress/compose": "^3.0.0",
 		"@wordpress/core-data": "^2.0.14",
@@ -66,11 +66,11 @@
 		"@wordpress/deprecated": "^2.0.3",
 		"@wordpress/dom": "^2.0.7",
 		"@wordpress/dom-ready": "^2.0.2",
-		"@wordpress/edit-post": "^3.1.3",
-		"@wordpress/editor": "^9.0.3",
+		"@wordpress/edit-post": "^3.1.4",
+		"@wordpress/editor": "^9.0.4",
 		"@wordpress/element": "^2.1.8",
 		"@wordpress/escape-html": "^1.0.1",
-		"@wordpress/format-library": "^1.2.6",
+		"@wordpress/format-library": "^1.2.7",
 		"@wordpress/hooks": "^2.0.3",
 		"@wordpress/html-entities": "^2.0.3",
 		"@wordpress/i18n": "^3.1.0",

src/wp-includes/class-wp-block-parser.php

@@ -359,6 +359,7 @@ function proceed() {
 	 *
 	 * @internal
 	 * @since 3.8.0
+	 * @since 4.6.1 fixed a bug in attribute parsing which caused catastrophic backtracking on invalid block comments
 	 * @return array
 	 */
 	function next_token() {
@@ -373,13 +374,18 @@ function next_token() {
 		 * match back in PHP to see which one it was.
 		 */
 		$has_match = preg_match(
-			'/<!--\s+(?<closer>\/)?wp:(?<namespace>[a-z][a-z0-9_-]*\/)?(?<name>[a-z][a-z0-9_-]*)\s+(?<attrs>{(?:[^}]+|}+(?=})|(?!}\s+-->).)*?}\s+)?(?<void>\/)?-->/s',
+			'/<!--\s+(?<closer>\/)?wp:(?<namespace>[a-z][a-z0-9_-]*\/)?(?<name>[a-z][a-z0-9_-]*)\s+(?<attrs>{(?:(?:[^}]+|}+(?=})|(?!}\s+\/?-->).)*+)?}\s+)?(?<void>\/)?-->/s',
 			$this->document,
 			$matches,
 			PREG_OFFSET_CAPTURE,
 			$this->offset
 		);
 
+		// if we get here we probably have catastrophic backtracking or out-of-memory in the PCRE
+		if ( false === $has_match ) {
+			return array( 'no-more-tokens', null, null, null, null );
+		}
+
 		// we have no more tokens
 		if ( 0 === $has_match ) {
 			return array( 'no-more-tokens', null, null, null, null );

src/wp-includes/script-loader.php

@@ -212,9 +212,9 @@ function wp_default_packages_scripts( &$scripts ) {
 		'annotations' => '1.0.3',
 		'autop' => '2.0.2',
 		'blob' => '2.1.0',
-		'block-library' => '2.2.8',
-		'block-serialization-default-parser' => '2.0.0',
-		'blocks' => '6.0.2',
+		'block-library' => '2.2.9',
+		'block-serialization-default-parser' => '2.0.1',
+		'blocks' => '6.0.3',
 		'components' => '7.0.3',
 		'compose' => '3.0.0',
 		'core-data' => '2.0.14',
@@ -223,11 +223,11 @@ function wp_default_packages_scripts( &$scripts ) {
 		'deprecated' => '2.0.3',
 		'dom' => '2.0.7',
 		'dom-ready' => '2.0.2',
-		'edit-post' => '3.1.3',
-		'editor' => '9.0.3',
+		'edit-post' => '3.1.4',
+		'editor' => '9.0.4',
 		'element' => '2.1.8',
 		'escape-html' => '1.0.1',
-		'format-library' => '1.2.6',
+		'format-library' => '1.2.7',
 		'hooks' => '2.0.3',
 		'html-entities' => '2.0.3',
 		'i18n' => '3.1.0',