Skip to content

Conversation

@krishana7911
Copy link
Contributor

Security Fix: Proper String Escaping in Regex and Query Handling

Summary

This PR addresses incomplete string escaping vulnerabilities identified by CodeQL in our JavaScript codebase.

Changes Made

  • Query Parameter Handling

    • Updated rtmediaGetParameterByName() and related functions to properly escape [ and ] in parameter names.
    • Changed single-occurrence regex replacements (/[\[]/) to global replacements (/\[/g), ensuring all instances are safely escaped.
  • Regex Escaping

    • Enhanced regex key escaping to also handle backslashes (\) in addition to ., +, and *.
    • Added inline comments explaining why escaping is necessary for regex safety and maintainability.

Why This Fix?

  • Previous implementations only escaped the first instance of [ or ], leaving room for bypasses.
  • Regex input escaping did not cover backslashes, potentially enabling malformed regex patterns.
  • These gaps could allow query string manipulation or regex injection leading to unexpected behavior.

Impact

  • Prevents potential XSS vectors or regex parsing issues.
  • No functional changes for end users; all behavior remains intact.

krishana7911 and others added 3 commits September 2, 2025 13:43
…ing or encoding

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…ing or encoding

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…ing or encoding

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@krishana7911 krishana7911 merged commit 5f9640f into develop Sep 2, 2025
4 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants