fix(autoInject): eliminate O(n²) stripComments and regex stack overflow (fixes failing ReDoS test)

lib/autoInject.js

@@ -8,37 +8,45 @@ var FN_ARG_SPLIT = /,/;
 var FN_ARG = /(=.+)?(\s*)$/;
 
 function stripComments(string) {
-    let stripped = '';
+    const parts = [];
     let index = 0;
+    let segmentStart = 0;
     let endBlockComment = string.indexOf('*/');
     while (index < string.length) {
         if (string[index] === '/' && string[index+1] === '/') {
-            // inline comment
+            // inline comment: flush current segment, skip to end of line
+            if (index > segmentStart) parts.push(string.slice(segmentStart, index));
             let endIndex = string.indexOf('\n', index);
             index = (endIndex === -1) ? string.length : endIndex;
+            segmentStart = index;
         } else if ((endBlockComment !== -1) && (string[index] === '/') && (string[index+1] === '*')) {
-            // block comment
+            // block comment: flush current segment, skip to end of block
+            if (index > segmentStart) parts.push(string.slice(segmentStart, index));
             let endIndex = string.indexOf('*/', index);
             if (endIndex !== -1) {
                 index = endIndex + 2;
                 endBlockComment = string.indexOf('*/', index);
             } else {
-                stripped += string[index];
-                index++;
+                index = string.length;
             }
+            segmentStart = index;
         } else {
-            stripped += string[index];
             index++;
         }
     }
-    return stripped;
+    if (segmentStart < string.length) parts.push(string.slice(segmentStart));
+    return parts.join('');
 }
 
 function parseParams(func) {
     const src = stripComments(func.toString());
     let match = src.match(FN_ARGS);
     if (!match) {
-        match = src.match(ARROW_FN_ARGS);
+        // Arrow functions always contain '=>'; skip the regex for inputs that
+        // lack it to avoid catastrophic backtracking on large non-function strings.
+        if (src.indexOf('=>') !== -1) {
+            match = src.match(ARROW_FN_ARGS);
+        }
     }
     if (!match) throw new Error('could not parse args in autoInject\nSource:\n' + src)
     let [, args] = match