From d848c99b7409dd5ab37b24fcbe16b8d188df6fde Mon Sep 17 00:00:00 2001
From: "Edward Z. Yang" <ezyang@mit.edu>
Date: Tue, 28 Sep 2010 10:22:38 -0400
Subject: [PATCH] Make IE conditional comment matching ungreedy.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
---
 NEWS                             |  4 ++++
 library/HTMLPurifier/Lexer.php   |  2 +-
 tests/HTMLPurifier/LexerTest.php | 26 +++++++++++++++++++-------
 3 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/NEWS b/NEWS
index c2e8abd5..e02fec38 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,10 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
     . Internal change
 ==========================
 
+4.2.1, unknown release date
+- Make removal of conditional IE comments ungreedy; thanks Bernd
+  for reporting.
+
 4.2.0, released 2010-09-15
 ! Added %Core.RemoveProcessingInstructions, which lets you remove
   <? ... ?> statements.
diff --git a/library/HTMLPurifier/Lexer.php b/library/HTMLPurifier/Lexer.php
index 325d5c5f..bf800c86 100644
--- a/library/HTMLPurifier/Lexer.php
+++ b/library/HTMLPurifier/Lexer.php
@@ -235,7 +235,7 @@ class HTMLPurifier_Lexer
      */
     protected static function removeIEConditional($string) {
         return preg_replace(
-            '#<!--\[if [^>]+\]>.*<!\[endif\]-->#si', // probably should generalize for all strings
+            '#<!--\[if [^>]+\]>.*?<!\[endif\]-->#si', // probably should generalize for all strings
             '',
             $string
         );
diff --git a/tests/HTMLPurifier/LexerTest.php b/tests/HTMLPurifier/LexerTest.php
index da582d15..abe1eb87 100644
--- a/tests/HTMLPurifier/LexerTest.php
+++ b/tests/HTMLPurifier/LexerTest.php
@@ -727,21 +727,33 @@ div {}
 
    function test_tokenizeHTML_removeNewline() {
         $this->config->set('Core.NormalizeNewlines', true);
-        $input = "plain\rtext\r\n";
-        $expect = array(
-            new HTMLPurifier_Token_Text("plain\ntext\n")
+        $this->assertTokenization(
+            "plain\rtext\r\n",
+            array(
+                new HTMLPurifier_Token_Text("plain\ntext\n")
+            )
         );
    }
 
    function test_tokenizeHTML_noRemoveNewline() {
         $this->config->set('Core.NormalizeNewlines', false);
-        $input = "plain\rtext\r\n";
-        $expect = array(
-            new HTMLPurifier_Token_Text("plain\rtext\r\n")
+        $this->assertTokenization(
+            "plain\rtext\r\n",
+            array(
+                new HTMLPurifier_Token_Text("plain\rtext\r\n")
+            )
         );
-        $this->assertTokenization($input, $expect);
      }
 
+    function test_tokenizeHTML_conditionalCommentUngreedy() {
+        $this->assertTokenization(
+            '<!--[if gte mso 9]>a<![endif]-->b<!--[if gte mso 9]>c<![endif]-->',
+            array(
+                new HTMLPurifier_Token_Text("b")
+            )
+        );
+    }
+
 
     /*
 
-- 
2.11.4.GIT