From 87c659cd676df43d2bb09a8a5eac2f4a88d1d6a0 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Fri, 20 Mar 2026 15:52:39 -0400
Subject: [PATCH] Skip auto-linking in very large text nodes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A large comment body was causing Regexp::TimeoutError in production.
The URI regexp isn't catastrophically backtracking — it's linear — but
with a long enough string it exceeds the 1s Regexp.timeout set by
Rails.

Skip scanning text nodes over 10KB, which is well beyond any
reasonable content for auto-linking and still keeps us many orders of
magnitued under the timeout on an unloaded machine.

Fixes FIZZY-Q4

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 lib/auto_link_scrubber.rb        |  4 ++++
 test/helpers/html_helper_test.rb | 11 +++++++++++
 2 files changed, 15 insertions(+)

diff --git a/lib/auto_link_scrubber.rb b/lib/auto_link_scrubber.rb
index 961c2c879..e36039be9 100644
--- a/lib/auto_link_scrubber.rb
+++ b/lib/auto_link_scrubber.rb
@@ -18,6 +18,8 @@ class AutoLinkScrubber < Loofah::Scrubber
   TRAILING_PUNCTUATION = %(.?,:!;"'<>)
   TRAILING_PUNCTUATION_REGEXP = /[#{Regexp.escape(TRAILING_PUNCTUATION)}]+\z/
 
+  MAX_TEXT_NODE_LENGTH = 10_000
+
   def initialize
     @direction = :top_down
     @regexp_timeout_reported = false
@@ -56,6 +58,8 @@ class AutoLinkScrubber < Loofah::Scrubber
     end
 
     def find_links(text)
+      return [] if text.length > MAX_TEXT_NODE_LENGTH
+
       links = []
 
       text.scan(AUTOLINK_REGEXP) do
diff --git a/test/helpers/html_helper_test.rb b/test/helpers/html_helper_test.rb
index f19d80003..b8a498774 100644
--- a/test/helpers/html_helper_test.rb
+++ b/test/helpers/html_helper_test.rb
@@ -125,6 +125,17 @@ class HtmlHelperTest < ActionView::TestCase
     end
   end
 
+  test "skip auto-linking in very large text nodes" do
+    url = "https://example.com"
+    large_text = "x" * 5_000 + " #{url} " + "y" * 5_000
+    input = "<p>#{large_text}</p>"
+
+    result = format_html(input)
+
+    assert_no_match(/<a/, result)
+    assert_includes result, url
+  end
+
   test "don't autolink content in excluded elements" do
     %w[ figcaption pre code ].each do |element|
       assert_equal_html \