这是indexloc提供的服务,不要输入任何密码
Skip to content
This repository was archived by the owner on Oct 4, 2024. It is now read-only.
This repository was archived by the owner on Oct 4, 2024. It is now read-only.

Regular Expression DoS vulnerability #389

@yinxiL

Description

@yinxiL

We are working on the ReDoS problem and detected 1 vulnerable regex(es) from your repository.

1: \[(?:\\.|[^\]])*?\]|\\.|\(\?[:=!]|(\() in firepad/test/vendor/ace-1.2.5.js

Please try the following:

var pattern = "\\[(?:\\\\.|[^\\]])*?\\]|\\\\.|\\(\\?[:=!]|(\\()";
var input = "[\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b\\\b";
var re = new RegExp(pattern);
var matched = input.match(re);

We didn’t create a pull request because we're not sure if these cases are possible to take place in your program, we also do not understand the functionality of these regexes as you do. Thank you for your understanding.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions