Skip to content

v3.2.1

Choose a tag to compare

View all tags
@rennf93 rennf93 released this 07 Oct 01:51
· 25 commits to master since this release
v3.2.1
This tag was signed with the committer’s verified signature.
rennf93 Renzo Franceschini
GPG key ID: B48363D3A3A4CF78
Verified
Learn about vigilant mode.
eef1537
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v3.2.1 (2026-10-07)

The ReDoS hardening release: linear endpoint normalization (v3.2.1)

About this release

  • A security fix release for the 4.3.x train. Clears the CodeQL js/polynomial-redos (high) finding on the endpoint normalization path. The guardagent package ships no runtime dependency surface changes and no behavior changes beyond the internals of trailing-slash stripping, which is observably identical.

Fixed (3.2.0 -> 3.2.1)

  • js/polynomial-redos: linear stripTrailingSlashes replaces anchored quantifier regexes. CodeQL flagged replace(/\/+$/, "") over endpoint URLs because the value comes from user configuration: an anchored quantifier over uncontrolled input is a polynomial ReDoS candidate. The new stripTrailingSlashes helper in src/utils.ts is a plain backward scan, linear by construction, with identical behavior (every trailing slash removed, none added). All three regex call sites in src/config.ts (normalizeEndpoint) and src/transport.ts (endpointBase) now use it.

Compatibility

  • Drop-in. Same public API, same normalizeEndpoint semantics, no dependency on @guardcore/core (unchanged from 3.2.0, so no core floor applies). Consumers on 3.2.0 can move to 3.2.1 with no code or config changes.
Assets 2
Loading