[fix] long whitespace is evil, don't allow it

There are broken sequences like "([^smth])*\s+" or "[^smth]+ *". This prevents abusing those.
3rd-Eden · Apr 3, 2019 · 687afe4 · 687afe4
1 parent c92567b
commit 687afe4
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/index.js b/index.js
@@ -417,8 +417,8 @@ function isSafe(userAgent) {
 
   for (var i = 0; i < userAgent.length; i++) {
     code = userAgent.charCodeAt(i);
-    // numbers between 0 and 9, letters between a and z
-    if ((code >= 48 && code <= 57) || (code >= 97 && code <= 122)) {
+    // numbers between 0 and 9, letters between a and z, spaces and control
+    if ((code >= 48 && code <= 57) || (code >= 97 && code <= 122) || code <= 32) {
       consecutive++;
     } else {
       consecutive = 0;