Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: avoid unsafe namespace regex #827

Closed
wants to merge 1 commit into from
Closed

fix: avoid unsafe namespace regex #827

wants to merge 1 commit into from

Conversation

ghost
Copy link

@ghost ghost commented May 11, 2021

Fixes #737

I decided to not throw on unsafe regexes to avoid introducing branching paths and fatal errors in existing installations. Instead they're ignored and a warning is logged.

Currently the log output is plain text, let me know if I should format it in a specific way.

@coveralls
Copy link

coveralls commented May 11, 2021

Coverage Status

Coverage increased (+0.8%) to 90.132% when pulling 4c21fc3 on jahed-snyk:fix/safe-regex into e47f96d on visionmedia:master.

@ghost ghost changed the title fix: ignore unsafe regex in namespace fix: avoid unsafe namespace regex May 11, 2021
@Qix-
Copy link
Member

Qix- commented May 11, 2021

Sorry, not very interested.

https://github.com/visionmedia/debug/pull/827/files#diff-13876b4beb64b9f156474dc78f9c923952a7ca210d4507b6b3135bbe244f8a60R152

This isn't how people use debug and I don't feel like pulling in another dependency just for this.

Will be more adequately addressed in v5.

@Qix- Qix- closed this May 11, 2021
@jp-diegidio
Copy link

The canonical solution for embedding literal text in a regex pattern is to escape the special regex characters in the text.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

Regex injection in enable(namespaces)
3 participants