New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerable Regular Expression #79

Open

cristianstaicu opened this issue Sep 6, 2017 · 0 comments

cristianstaicu commented Sep 6, 2017

The following regular expression used in parsing the HTML documents is vulnerable to ReDoS:

/(^\s+|\s+$)/g

The slowdown is moderately low: for 50.000 characters around 2.5 seconds matching time. However, I would still suggest one of the following:

remove the regex,
anchor the regex,
limit the number of characters that can be matched by the repetition,
limit the input size.

If needed, I can provide an actual example showing the slowdown.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment