Release v2.12.0

v2.12.0

Changelog

Security: item pathPattern is validated on save (no uncompilable or catastrophic-backtracking patterns). See UPGRADING.

Security

• Item pathPattern is validated on save. The editor-supplied PCRE body is compiled as #…#u on every request
  that reaches the matcher, but was only length-checked. A catastrophic-backtracking pattern such as ^/(a+)+$
  burned CPU up to PCRE's backtrack limit per request (denial of service by a dashboard user). The dashboard form now
  rejects patterns that do not compile or use nested quantifiers (form.breadcrumb_item.path_pattern.invalid), and the
  JSON import leaves them empty and reports import.error.path_pattern_rejected (BreadcrumbPathPatternValidator).

What's Changed

• fix(security): validate item pathPattern on save (ReDoS) by @HecFranco in #60

Full Changelog: v2.11.0...v2.12.0