Skip to content

Commit

Permalink
(#7115) - Remove catastrophic backtracking vulnerability
Browse files Browse the repository at this point in the history
Problem:
A regex to parse function names was vulnerable to catastrophic
backtracking.

Solution:
Alter the regex to make it safe.
The new regex matches the same language.

This regex is not exploitable for REDOS as currently used.
This change is for future-proofing.
  • Loading branch information
davisjam authored and daleharvey committed Mar 4, 2018
1 parent d6cece3 commit 64894da
Showing 1 changed file with 7 additions and 1 deletion.
8 changes: 7 additions & 1 deletion packages/node_modules/pouchdb-utils/src/functionName.js
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,13 @@ if (hasName) {
};
} else {
res = function (fun) {
return fun.toString().match(/^\s*function\s*(\S*)\s*\(/)[1];
var match = fun.toString().match(/^\s*function\s*(?:(\S+)\s*)?\(/);
if (match && match[1]) {
return match[1];
}
else {
return '';
}
};
}

Expand Down

0 comments on commit 64894da

Please sign in to comment.