Skip to content

Commit 17bec4a

Browse files
authored
fix(api): fix inefficient RegExp that may cause ReDoS
Fixes inefficient RegExp which could cause Regular expression Denial of Service attack The problematic part (?:\[(?:\d*|[a-z0-9_-]+)\])* will matches (empty) [] [0123] [abcd] [0a_1b_c2] [][] [0123][] [abcd][0a_1b_c2] All these pattern is covered with the fixed regexp, I think.
1 parent 04f70a7 commit 17bec4a

File tree

1 file changed

+1
-1
lines changed
  • src/definitions/behaviors

1 file changed

+1
-1
lines changed

src/definitions/behaviors/api.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1208,7 +1208,7 @@ $.api.settings = {
12081208
regExp : {
12091209
required : /\{\$*[A-z0-9]+\}/g,
12101210
optional : /\{\/\$*[A-z0-9]+\}/g,
1211-
validate: /^[a-z_][a-z0-9_-]*(?:\[(?:\d*|[a-z0-9_-]+)\])*$/i,
1211+
validate: /^[a-z_][a-z0-9_-]*(?:\[[a-z0-9_-]*\])*$/i,
12121212
key: /[a-z0-9_-]+|(?=\[\])/gi,
12131213
push: /^$/,
12141214
fixed: /^\d+$/,

0 commit comments

Comments
 (0)