Skip to content

Commit

Permalink
fix(api): fix inefficient RegExp that may cause ReDoS
Browse files Browse the repository at this point in the history
Fixes inefficient RegExp which could cause Regular expression Denial of Service attack

The problematic part (?:\[(?:\d*|[a-z0-9_-]+)\])* will matches

(empty)
[]
[0123]
[abcd]
[0a_1b_c2]
[][]
[0123][]
[abcd][0a_1b_c2]
All these pattern is covered with the fixed regexp, I think.
  • Loading branch information
exoego committed Apr 30, 2022
1 parent 04f70a7 commit 17bec4a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/definitions/behaviors/api.js
Original file line number Diff line number Diff line change
Expand Up @@ -1208,7 +1208,7 @@ $.api.settings = {
regExp : {
required : /\{\$*[A-z0-9]+\}/g,
optional : /\{\/\$*[A-z0-9]+\}/g,
validate: /^[a-z_][a-z0-9_-]*(?:\[(?:\d*|[a-z0-9_-]+)\])*$/i,
validate: /^[a-z_][a-z0-9_-]*(?:\[[a-z0-9_-]*\])*$/i,
key: /[a-z0-9_-]+|(?=\[\])/gi,
push: /^$/,
fixed: /^\d+$/,
Expand Down

0 comments on commit 17bec4a

Please sign in to comment.