Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix an inefficient regex in autoInject #1767

Merged
merged 7 commits into from Dec 2, 2021
Merged
Show file tree
Hide file tree
Changes from 5 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion lib/autoInject.js
Expand Up @@ -6,7 +6,7 @@ var FN_ARGS = /^(?:async\s+)?(?:function)?\s*\w*\s*\(\s*([^)]+)\s*\)(?:\s*{)/;
var ARROW_FN_ARGS = /^(?:async\s+)?\(?\s*([^)=]+)\s*\)?(?:\s*=>)/;
var FN_ARG_SPLIT = /,/;
var FN_ARG = /(=.+)?(\s*)$/;
var STRIP_COMMENTS = /((\/\/.*$)|(\/\*[\s\S]*?\*\/))/mg;
var STRIP_COMMENTS = /(\/\*(?:[^/]|\/(?!\*))*\*\/)|\/\/.*$/mg;

function parseParams(func) {
const src = func.toString().replace(STRIP_COMMENTS, '');
Expand Down
29 changes: 29 additions & 0 deletions test/autoInject.js
Expand Up @@ -224,4 +224,33 @@ describe('autoInject', () => {
done()
})
})

it('should not be subject to ReDoS', () => {
Copy link
Contributor

@Trott Trott Nov 28, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this line indented too far? (I'm surprised if there isn't a lint rule for this.)

// This test will timeout if the bug is present.
var someComments = 'text/*'.repeat(1000000)
expect(() => async.autoInject({
someComments,
a () {}
})).to.throw()
});

it('should properly strip comments in argument definitions', (done) => {
async.autoInject({
task1: function(task2, /* ) */ callback) {
callback(null, true);
},
task2: function task2(task3 // )
,callback) {
callback(null, true);
},
task3: function task3(callback) {
callback(null, true);
}
},
(err, result) => {
expect(err).to.eql(null);
expect(result).to.deep.eql({task1: true, task2: true, task3: true});
done();
});
});
});