Skip to content

Vulnerability introduced by match operation can lead to reDoS #5

@petruki

Description

@petruki

Describe the bug
Strategy:REGEX using operations EXIST and NOT_EXIST are vulnerable to unintentional resource exploitation using regular expression.

To Reproduce
Configure offline snapshot to use evil regex, then trigger the SDK using an evil input.

Expected behavior
String.match should return false if it fails to complete the operation.

deno 1.30.1 (release, x86_64-pc-windows-msvc)
v8 10.9.194.5
typescript 4.9.4

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingenhancementNew feature or request

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions