Use a timeout when validating NuGet package id

NuGet · Apr 2, 2021 · a0671e9 · a0671e9
1 parent 606dcb6
commit a0671e9
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 1 deletion.
diff --git a/src/NuGet.Core/NuGet.Packaging/PackageCreation/Utility/PackageIdValidator.cs b/src/NuGet.Core/NuGet.Packaging/PackageCreation/Utility/PackageIdValidator.cs
@@ -11,7 +11,9 @@ namespace NuGet.Packaging
     public static class PackageIdValidator
     {
         public const int MaxPackageIdLength = 100;
-        private static readonly Regex IdRegex = new Regex(@"^\w+([_.-]\w+)*$", RegexOptions.IgnoreCase | RegexOptions.ExplicitCapture | RegexOptions.CultureInvariant);
+        private static readonly Regex IdRegex = new Regex(pattern: @"^\w+([.-]\w+)*$",
+            options: RegexOptions.IgnoreCase | RegexOptions.ExplicitCapture | RegexOptions.CultureInvariant,
+            matchTimeout: TimeSpan.FromSeconds(10));
 
         public static bool IsValidPackageId(string packageId)
         {

diff --git a/test/NuGet.Core.Tests/NuGet.Packaging.Test/PackageIdValidatorTest.cs b/test/NuGet.Core.Tests/NuGet.Packaging.Test/PackageIdValidatorTest.cs
@@ -159,6 +159,32 @@ public void DotToolsIsNotAllowed()
             Assert.False(isValid);
         }
 
+        [Fact]
+        public void IsValidPackageId_PackageIdWithTwoUnderscores_Success()
+        {
+            // Arrange
+            string packageId = "Hello__World";
+
+            // Act
+            bool isValid = PackageIdValidator.IsValidPackageId(packageId);
+
+            // Assert
+            Assert.True(isValid);
+        }
+
+        [Fact]
+        public void IsValidPackageId_LongPackageIdWithUnMatchedCharAtTheEnd_Fails()
+        {
+            // Arrange
+            string packageId = string.Concat(new string('_', 100), "!");
+
+            // Act
+            bool isValid = PackageIdValidator.IsValidPackageId(packageId);
+
+            // Assert
+            Assert.False(isValid);
+        }
+
         [Theory]
         [InlineData(101)]
         [InlineData(102)]