Skip to content

Commit bc1849c

Browse files
authored
fix(api): create regexp alias to fix snyk redos false positive
This change fixes the false positive snyk warning about a possible Redos regex attack. Synk does not correctly detect the settings reference, because the related regexes themselves are safe (checked via devina.io/redos-checker)
1 parent f2aad7e commit bc1849c

File tree

1 file changed

+7
-6
lines changed
  • src/definitions/behaviors

1 file changed

+7
-6
lines changed

src/definitions/behaviors/api.js

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@
5858
: $.extend({}, $.fn.api.settings),
5959

6060
// internal aliases
61+
regExp = settings.regExp,
6162
namespace = settings.namespace,
6263
metadata = settings.metadata,
6364
selector = settings.selector,
@@ -360,8 +361,8 @@
360361
optionalVariables
361362
;
362363
if (url) {
363-
requiredVariables = url.match(settings.regExp.required);
364-
optionalVariables = url.match(settings.regExp.optional);
364+
requiredVariables = url.match(regExp.required);
365+
optionalVariables = url.match(regExp.optional);
365366
urlData = urlData || settings.urlData;
366367
if (requiredVariables) {
367368
module.debug('Looking for required URL variables', requiredVariables);
@@ -458,7 +459,7 @@
458459
});
459460
});
460461
$.each(formArray, function (i, el) {
461-
if (!settings.regExp.validate.test(el.name)) {
462+
if (!regExp.validate.test(el.name)) {
462463
return;
463464
}
464465
var
@@ -469,7 +470,7 @@
469470
|| (String(floatValue) === el.value
470471
? floatValue
471472
: (el.value === 'false' ? false : el.value)),
472-
nameKeys = el.name.match(settings.regExp.key) || [],
473+
nameKeys = el.name.match(regExp.key) || [],
473474
pushKey = el.name.replace(/\[]$/, '')
474475
;
475476
if (!(pushKey in pushes)) {
@@ -489,9 +490,9 @@
489490

490491
if (k === '' && !Array.isArray(value)) { // foo[]
491492
value = build([], pushes[pushKey]++, value);
492-
} else if (settings.regExp.fixed.test(k)) { // foo[n]
493+
} else if (regExp.fixed.test(k)) { // foo[n]
493494
value = build([], k, value);
494-
} else if (settings.regExp.named.test(k)) { // foo; foo[bar]
495+
} else if (regExp.named.test(k)) { // foo; foo[bar]
495496
value = build({}, k, value);
496497
}
497498
}

0 commit comments

Comments
 (0)