Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Denial Of Service Vulnerability #9

Closed
wants to merge 1 commit into from

Conversation

Hbkhan
Copy link

@Hbkhan Hbkhan commented Jul 3, 2020

Affected versions of this package are vulnerable to Denial of Service. An attacker providing a very long url can cause a Denial of Service. The vulnerability exists in #L11

PoC

const isUrlHttp = require('is-url-http')
isUrlHttp('https://kikobeats.test.3423423423sadasd.1312321321sadsadsad.21312312321asdasdsa.21312321asdasda.21312312312adasd23423.sadasdasd231412321.34234234asdasdasdasdassdasd.34234234asdasdas')

Fixes #7

@coveralls
Copy link

coveralls commented Jul 3, 2020

Pull Request Test Coverage Report for Build 65

  • 2 of 2 (100.0%) changed or added relevant lines in 1 file are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 90.0%

Totals Coverage Status
Change from base Build 61: 0.0%
Covered Lines: 14
Relevant Lines: 14

💛 - Coveralls

@Kikobeats
Copy link
Owner

Resolved at a205c30

@Kikobeats Kikobeats closed this Oct 12, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Denial of Service in is-url-http
3 participants