Skip to content

Commit

Permalink
path: unwind regular expressions in Windows
Browse files Browse the repository at this point in the history
This is the second part to removing REDOS vulnerabilities from v4.x

The function `splitTailRe` exposed a REDOS vulnerability. It was only
utilized in the Windows implementation of a number of the path utilities.
In v6.x a change landed that unwound this regular expression, and in
turn patched the vulnerability.

This commit copies the unwound implementation currently found on v8.x.
It is completely self contained. I attempted to keep all warnings
and deprecations the same as the v4.x implementation, but may have
missed something buried in the large unwound functions.

Refs: b212be08f6
  • Loading branch information
MylesBorins committed Feb 22, 2018
1 parent 4196fcf commit bf00665
Showing 1 changed file with 396 additions and 44 deletions.
Loading

0 comments on commit bf00665

Please sign in to comment.