Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No RexExp parser #100

Merged
merged 6 commits into from Feb 24, 2018
Merged

No RexExp parser #100

merged 6 commits into from Feb 24, 2018

Commits on Sep 21, 2017

  1. 2.3.3

    stash-sfdc committed Sep 21, 2017
    Copy the full SHA
    12d4266 View commit details
    Browse the repository at this point in the history

Commits on Sep 22, 2017

  1. Parse cookie-pair part without regexp

    Specifically to avoid any more hidden ReDoS in those regexes.
    
    Seems to run tests in 6.9s vs 7.0s so might be a bit of a speed bonus on
    some platforms!
    stash-sfdc committed Sep 22, 2017
    Copy the full SHA
    c9bd79d View commit details
    Browse the repository at this point in the history
  2. Avoid unbounded Regexp parts in date parsing

    Replaces a bunch of `[^\d]*$` with bounded `(?:[^\d]|$)`
    
    Double checked the RFC6265 spec: time cannot have non-digits beside the
    colons.
    stash-sfdc committed Sep 22, 2017
    Copy the full SHA
    2a4775c View commit details
    Browse the repository at this point in the history
  3. Copy the full SHA
    8614dbf View commit details
    Browse the repository at this point in the history
  4. Convert date-time parser from regexp, expand tests

    None of the regexps (at least, when they were removed) are vulnerable to
    ReDoS. However, took this opportunity to check that the RFC is being
    closer and more clearly documented where in the code.
    
    Another way to put this: "regexps are magic and hinder code analysis"
    
    Introduced some equivalence tests to ensure that certain "weird" dates
    are indeed parsing the same as their "canonical" RFC6265 counterpart.
    stash-sfdc committed Sep 22, 2017
    Copy the full SHA
    8452ccd View commit details
    Browse the repository at this point in the history
  5. Copy the full SHA
    751da6d View commit details
    Browse the repository at this point in the history