Harden against pathological inputs

cssesc.js

@@ -19,7 +19,7 @@ var merge = function merge(options, defaults) {
 var regexAnySingleEscape = /[ -,\.\/:-@\[-\^`\{-~]/;
 var regexSingleEscape = /[ -,\.\/:-@\[\]\^`\{-~]/;
 var regexAlwaysEscape = /['"\\]/;
-var regexExcessiveSpaces = /(^|\\+)?(\\[A-F0-9]{1,6})\x20(?![a-fA-F0-9\x20])/g;
+var regexExcessiveSpaces = /(^|\\)?(\\[A-F0-9]{1,6})\x20(?![a-fA-F0-9\x20])/g;
 
 // https://mathiasbynens.be/notes/css-escapes#css
 var cssesc = function cssesc(string, options) {

src/cssesc.js

@@ -21,7 +21,7 @@ const merge = (options, defaults) => {
 const regexAnySingleEscape = /<%= anySingleEscape %>/;
 const regexSingleEscape = /<%= singleEscapes %>/;
 const regexAlwaysEscape = /['"\\]/;
-const regexExcessiveSpaces = /(^|\\+)?(\\[A-F0-9]{1,6})\x20(?![a-fA-F0-9\x20])/g;
+const regexExcessiveSpaces = /(^|\\)?(\\[A-F0-9]{1,6})\x20(?![a-fA-F0-9\x20])/g;
 
 // https://mathiasbynens.be/notes/css-escapes#css
 const cssesc = (string, options) => {

tests/tests.js

@@ -182,5 +182,6 @@ describe('common usage', () => {
 			'\\6C\\6F\\6C\\77\\61\\74\\"\\66\\6F\\6F\\\'\\62\\61\\72\\A9\\6B',
 			'`escapeEverything: true`'
 		);
+		assert.ok(cssesc(`${'\\'.repeat(50000)}A`), 'test timed out');
 	});
 });