Remove nested quantifier

https://hackerone.com/reports/660822

Author: nobu

lib/net/imap/authenticators/digest_md5.rb

@@ -15,7 +15,7 @@ def process(challenge)
       @stage = STAGE_TWO
       sparams = {}
       c = StringScanner.new(challenge)
-      while c.scan(/(?:\s*,)?\s*(\w+)=("(?:[^\\"]+|\\.)*"|[^,]+)\s*/)
+      while c.scan(/(?:\s*,)?\s*(\w+)=("(?:[^\\"]|\\.)*"|[^,]+)\s*/)
         k, v = c[1], c[2]
         if v =~ /^"(.*)"$/
           v = $1

test/net/imap/test_imap_authenticators.rb

@@ -153,4 +153,14 @@ def test_digest_md5_authenticator_no_qop
       auth.process('Qop=""')
     end
   end
+
+  def test_digest_md5_authenticator_illinear
+    pre = ->(n) {'qop="a' + ',x'*n}
+    assert_linear_performance([5, 10, 15, 20], pre: pre) do |challenge|
+      auth = digest_md5("user", "pass")
+      assert_raise(Net::IMAP::DataFormatError) do
+        auth.process(challenge)
+      end
+    end
+  end
 end