fix(rtrim): remove regex to prevent ReDOS attack #1738
Conversation
Codecov Report
@@ Coverage Diff @@
## master #1738 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 102 102
Lines 2015 2020 +5
Branches 454 454
=========================================
+ Hits 2015 2020 +5
Continue to review full report at Codecov.
|
| return str.replace(pattern, ''); | ||
| } | ||
| // Use a faster and more safe than regex trim method https://blog.stevenlevithan.com/archives/faster-trim-javascript | ||
| let strIndex = str.length - 1; |
There was a problem hiding this comment.
I am wondering why this is not in the else statement, but I might less understand that because we have done return already.
There was a problem hiding this comment.
It's exactly that. If an if block contains a return statement, the else block is unnecessary and the instructions after the block will only be executed when the if condition is not met!
|
@tux-tn -- sorry missed on this one, will get it in for the release. Thanks! |
This PR fixes a potential ReDOS in
rtrimsanitizer. A try has been made in #1603 to fix the same vulnerability but it looks like we failed to prevent it.The new implementation is not based on regex and is inspired by Steven Levithan's blog post and trim package implementation.
Thanks to @yetingli for discovering the vulnerability and huntr.dev for reporting it
Checklist