fix: 存在潜在的 ReDoS 漏洞或低效正则表达式

packages/css-to-react-native/__tests__/index.spec.js

@@ -3636,3 +3636,19 @@ describe('ICSS :export pseudo-selector', () => {
     ).toThrow()
   })
 })
+describe('ReDos', () => {
+  jest.setTimeout(1000)
+  it('should finish transform of 100k zeros + "p" in under 1s', () => {
+    const bigValue = '0'.repeat(100000) + 'p'
+    const cssString = `
+      .foo { some-prop: "${bigValue}"; }
+    `
+    const start = performance.now()
+    transform(cssString, {
+      scalable: false,
+      parseMediaQueries: false
+    })
+    const duration = performance.now() - start
+    expect(duration).toBeLessThan(1000)
+  })
+})

packages/css-to-react-native/src/index.js

@@ -57,9 +57,9 @@ const transformDecls = (styles, declarations, result, options = {}) => {
     if (
       typeof options.scalable === 'boolean' &&
       !options.scalable &&
-      /(\d+)px/.test(value)
+      /(?<!\d)(\d+)px/.test(value)
     ) {
-      value = value.replace(/(\d+)px/g, '$1PX')
+      value = value.replace(/(?<!\d)(\d+)px/g, '$1PX')
     }
     // expect value is legal so that remove !import
     if (/!import/i.test(value)) {

packages/css-to-react-native/src/transforms/rem.js

@@ -1,3 +1,3 @@
 export const remToPx = value => {
-  return value.replace(/(\d*\.?\d+)rem/g, (match, m1) => parseFloat(m1, 10) * 16 + 'px')
+  return value.replace(/(?<!\d)((?:\d*\.\d+)|\d+)rem/g, (match, m1) => parseFloat(m1, 10) * 16 + 'px')
 }