Add backtrack protection to 3.x release (#321)

Author: blakeembrey

index.js

@@ -90,6 +90,7 @@ function parse (str, options) {
     var optional = modifier === '?' || modifier === '*'
     var pattern = capture || group
     var delimiter = prev || defaultDelimiter
+    var prevText = prev || (typeof tokens[tokens.length - 1] === 'string' ? tokens[tokens.length - 1] : '')
 
     tokens.push({
       name: name || key++,
@@ -99,7 +100,7 @@ function parse (str, options) {
       repeat: repeat,
       pattern: pattern
         ? escapeGroup(pattern)
-        : '[^' + escapeString(delimiter === defaultDelimiter ? delimiter : (delimiter + defaultDelimiter)) + ']+?'
+        : restrictBacktrack(delimiter, defaultDelimiter, prevText)
     })
   }
 
@@ -111,6 +112,16 @@ function parse (str, options) {
   return tokens
 }
 
+function restrictBacktrack (delimiter, defaultDelimiter, prevText) {
+  var charGroup = '[^' + escapeString(delimiter === defaultDelimiter ? delimiter : (delimiter + defaultDelimiter)) + ']'
+
+  if (!prevText || prevText.indexOf(delimiter) > -1 || prevText.indexOf(defaultDelimiter) > -1) {
+    return charGroup + '+?'
+  }
+
+  return escapeString(prevText) + '|(?:(?!' + escapeString(prevText) + ')' + charGroup + ')+?'
+}
+
 /**
  * Compile a string to a template function for the path.
  *

package-lock.json

@@ -2206,7 +2206,7 @@ var TESTS: Test[] = [
         delimiter: '/',
         optional: true,
         repeat: false,
-        pattern: '[^\\/]+?'
+        pattern: '\\(|(?:(?!\\()[^\\/])+?'
       },
       ')'
     ],
@@ -2633,7 +2633,7 @@ var TESTS: Test[] = [
         delimiter: '/',
         name: 'attr2',
         optional: true,
-        pattern: '[^\\/]+?',
+        pattern: '-|(?:(?!-)[^\\/])+?',
         prefix: '',
         repeat: false
       }
@@ -2642,7 +2642,7 @@ var TESTS: Test[] = [
       ['name/1', null],
       ['name/1-', ['name/1-', '1', undefined]],
       ['name/1-2', ['name/1-2', '1', '2']],
-      ['name/1-2-3', ['name/1-2-3', '1', '2-3']],
+      ['name/1-2-3', ['name/1-2-3', '1-2', '3']],
       ['name/foo-bar/route', null],
       ['name/test/route', null]
     ],