fix(html-comments): changed regex to precent malformed long comment to freeze showdown

Closes #439

Author: tivie

dist/showdown.js

@@ -6,16 +6,22 @@ showdown.subParser('escapeSpecialCharsWithinTagAttributes', function (text, opti
   'use strict';
   text = globals.converter._dispatch('escapeSpecialCharsWithinTagAttributes.before', text, options, globals);
 
-  // Build a regex to find HTML tags and comments.  See Friedl's
-  // "Mastering Regular Expressions", 2nd Ed., pp. 200-201.
-  var regex = /(<[a-z\/!$]("[^"]*"|'[^']*'|[^'">])*>|<!(--.*?--\s*)+>)/gi;
+  // Build a regex to find HTML tags.
+  var regex = /(<[a-z\/!$]("[^"]*"|'[^']*'|[^'">])*>)/gi,
+  // due to catastrophic backtrace we split the old regex into two, one for tags and one for comments
+      regexComments = /<!(--(?:|(?:[^>-]|-[^>])(?:[^-]|-[^-])*)--)>/gi;
 
   text = text.replace(regex, function (wholeMatch) {
     return wholeMatch
       .replace(/(.)<\/?code>(?=.)/g, '$1`')
       .replace(/([\\`*_~=|])/g, showdown.helper.escapeCharactersCallback);
   });
 
+  text = text.replace(regexComments, function (wholeMatch) {
+    return wholeMatch
+      .replace(/([\\`*_~=|])/g, showdown.helper.escapeCharactersCallback);
+  });
+
   text = globals.converter._dispatch('escapeSpecialCharsWithinTagAttributes.after', text, options, globals);
   return text;
 });

dist/showdown.js.map

@@ -6,3 +6,5 @@
    <!-- comment -->
 <pre><code>&lt;!-- comment --&gt;
 </code></pre>
+<p>&lt;!----------------------------------------------------------------------------------------------------------------------------------------------------</p>
+<!-------------------------------------------------------------------->

dist/showdown.min.js

@@ -9,3 +9,7 @@ words <!-- a comment --> words
    <!-- comment -->
 
     <!-- comment -->
+
+<!----------------------------------------------------------------------------------------------------------------------------------------------------
+
+<!-------------------------------------------------------------------->