fix(isSlug & rtrim): regex no longer exposed to ReDOS attacks (#1603)

Author: fedeci

src/lib/isSlug.js

@@ -1,6 +1,6 @@
 import assertString from './util/assertString';
 
-let charsetRegex = /^[^\s-_](?!.*?[-_]{2,})([a-z0-9-\\]{1,})[^\s]*[^-_\s]$/;
+let charsetRegex = /^[^\s-_](?!.*?[-_]{2,})[a-z0-9-\\][^\s]*[^-_\s]$/;
 
 export default function isSlug(str) {
   assertString(str);

src/lib/rtrim.js

@@ -3,6 +3,6 @@ import assertString from './util/assertString';
 export default function rtrim(str, chars) {
   assertString(str);
   // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
-  const pattern = chars ? new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g') : /\s+$/g;
+  const pattern = chars ? new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g') : /(\s)+$/g;
   return str.replace(pattern, '');
 }