Merge branch 'security-fix-quick-actions-extractor-regex-539' into 'master'

Prevent quick actions regex from backtracking

See merge request gitlab-org/security/gitlab!1951

lib/gitlab/quick_actions/extractor.rb

@@ -29,9 +29,7 @@ module Gitlab
           # Anything, including `/cmd arg` which are ignored by this filter
           # `
 
-          `\n*
-          .+?
-          \n*`
+          `.+?`
         )
       }mix.freeze
 

spec/lib/gitlab/quick_actions/extractor_spec.rb

@@ -352,6 +352,14 @@ RSpec.describe Gitlab::QuickActions::Extractor do
       expect(commands).to eq(expected_commands)
       expect(msg).to eq expected_msg
     end
+
+    it 'fails fast for strings with many newlines' do
+      msg = '`' + "\n" * 100_000
+
+      expect do
+        Timeout.timeout(3.seconds) { extractor.extract_commands(msg) }
+      end.not_to raise_error
+    end
   end
 
   describe '#redact_commands' do