Merge pull request from GHSA-4q6p-r6v2-jvc5

chaijs · Sep 26, 2023 · f934b22 · f934b22
1 parent 1436af2
commit f934b22
Show file tree

Hide file tree

Showing 3 changed files with 9,027 additions and 6,174 deletions.
diff --git a/index.js b/index.js
@@ -13,6 +13,7 @@
 
 const { toString } = Function.prototype;
 const functionNameMatch = /\s*function(?:\s|\s*\/\*[^(?:*/)]+\*\/\s*)*([^\s(/]+)/;
+const maxFunctionSourceLength = 512;
 function getFuncName(aFunc) {
   if (typeof aFunc !== 'function') {
     return null;
@@ -22,6 +23,12 @@ function getFuncName(aFunc) {
   if (typeof Function.prototype.name === 'undefined' && typeof aFunc.name === 'undefined') {
     // Here we run a polyfill if Function does not support the `name` property and if aFunc.name is not defined
     // eslint-disable-next-line prefer-reflect
+    const functionSource = toString.call(aFunc);
+    // To avoid unconstrained resource consumption due to pathalogically large function names,
+    // we limit the available return value to be less than 512 characters.
+    if (functionSource.indexOf('(') > maxFunctionSourceLength) {
+      return name;
+    }
     const match = toString.call(aFunc).match(functionNameMatch);
     if (match) {
       [ name ] = match;