Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 1 addition & 18 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 1 addition & 2 deletions packages/input_schema/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -52,8 +52,7 @@
"@apify/input_secrets": "^1.2.11",
"@apify/json_schemas": "^0.7.0",
"acorn-loose": "^8.4.0",
"countries-list": "^3.0.0",
"safe-regex": "^2.1.1"
"countries-list": "^3.0.0"
},
"peerDependencies": {
"ajv": "^8.0.0"
Expand Down
15 changes: 7 additions & 8 deletions packages/input_schema/src/utilities.ts
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ import { parse } from 'acorn-loose';
import type { ValidateFunction } from 'ajv';
import type Ajv from 'ajv/dist/2019';
import { countries } from 'countries-list';
import safe from 'safe-regex';

import { PROXY_URL_REGEX, URL_REGEX } from '@apify/consts';
import { isEncryptedValueForFieldSchema, isEncryptedValueForFieldType } from '@apify/input_secrets';
Expand Down Expand Up @@ -369,19 +368,19 @@ export function ensureAjvSupportsDraft2019(ajvInstance: Ajv) {
* @param fieldKey The field key where the pattern is used (for error messages).
*/
export function validateRegexpPattern(pattern: string, fieldKey: string) {
let regex: RegExp;

try {
// Validate that the pattern is a valid regular expression
regex = new RegExp(pattern);
// eslint-disable-next-line
new RegExp(pattern);
} catch {
const message = m('inputSchema.validation.regexpNotValid', { pattern, fieldKey });
throw new Error(`Input schema is not valid (${message})`);
}

// TODO: add check for safe regex but figure out how to avoid false positives with some valid regexes
// Check if the regex is safe (to avoid ReDoS attacks)
if (!safe(regex)) {
const message = m('inputSchema.validation.regexpNotSafe', { pattern, fieldKey });
throw new Error(`Input schema is not valid (${message})`);
}
// if (!safe(regex)) {
// const message = m('inputSchema.validation.regexpNotSafe', { pattern, fieldKey });
// throw new Error(`Input schema is not valid (${message})`);
// }
}
43 changes: 0 additions & 43 deletions test/input_schema.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -1066,49 +1066,6 @@ describe('input_schema.json', () => {
'Input schema is not valid (The regular expression "^[0-9+$" in field schema.properties.objectField.patternValue must be valid.)',
);
});

it('should throw error on not safe regexp', () => {
const invalidRegexps = [
'(a+)+$',
'^(a|a?)+$',
'^(a|a*)+$',
'^(a|a+)+$',
'^(a?)+$',
'^(a*)+$',
'^(a+)*$',
'^(a|aa?)+$',
'^(a|aa*)+$',
'^(a|a+)*$',
'^(a|a?)*$',
'^(a|a*)*$',
'^(a?)*$',
'^(a*)*$',
'^(a+)?$',
'^(a*)?$',
'a*b*c*d*e*f*g*h*i*j*k*l*m*n*o*p*q*r*s*t*u*v*w*x*y*z*',
];

for (const pattern of invalidRegexps) {
const schema = {
title: 'Test input schema',
type: 'object',
schemaVersion: 1,
properties: {
myField: {
title: 'Field title',
type: 'string',
description: 'Some description ...',
editor: 'textfield',
pattern,
},
},
};

expect(() => validateInputSchema(validator, schema)).toThrow(
`Input schema is not valid (The regular expression "${pattern}" in field schema.properties.myField.pattern may cause excessive backtracking or be unsafe to execute.)`,
);
}
});
});
});
});