Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerable RegExp in BodyConverter #218

Closed
ostridm opened this issue Nov 14, 2023 · 0 comments · Fixed by #219
Closed

Vulnerable RegExp in BodyConverter #218

ostridm opened this issue Nov 14, 2023 · 0 comments · Fixed by #219
Assignees
@ostridm
Labels
Type: bug Something isn't working.

Comments

@ostridm
Copy link
Contributor

ostridm commented Nov 14, 2023 •
edited by derevnjuk
Loading

This regular expression is vulnerable for ReDoS due P complexity

    const [mime]: string[] = contentType
      .split(',')
      .map((x) => x.trim().replace(/;.+?$/, ''));

Prevent the ReDoS or refuse to use the regexp in this particular case.

Please refer to the source code at BodyConverter.ts#L60-L63
@ostridm ostridm added the Type: refactoring Changes in the way the code works internally without changing the output produced. label Nov 14, 2023
@ostridm ostridm self-assigned this Nov 14, 2023
ostridm added a commit that referenced this issue Nov 14, 2023
@ostridm
refactor(oas): get rid of regexp in BodyConverter
954b170 
closes #218
@ostridm ostridm mentioned this issue Nov 14, 2023
Merged
@derevnjuk derevnjuk changed the title OAS: get rid of using regexp in BodyConverter Vulnerable RegExp in BodyConverter Nov 14, 2023
@derevnjuk derevnjuk added Type: bug Something isn't working. and removed Type: refactoring Changes in the way the code works internally without changing the output produced. labels Nov 14, 2023
derevnjuk pushed a commit that referenced this issue Nov 14, 2023
@ostridm
fix(oas): prevent ReDoS in the BodyConverter (#219)
30eb0e4 
closes #218
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ostridm ostridm

Labels
Type: bug Something isn't working.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(oas): prevent ReDoS in the BodyConverter NeuraLegion/har-sdk
2 participants
@ostridm @derevnjuk