5 ms·
I'm watching a movie so I haven't looked too deeply at this, but your regexes aren't safe from ReDoS according to substack's safe-regex [1]. It might be worth f
by micaksica 10y ago
I'm watching a movie so I haven't looked too deeply at this, but your regexes aren't safe from ReDoS according to substack's safe-regex [1]. It might be worth finding a non-regex-based way to parse regular expressions in case of some weird routes that could cause exponential-time parsing.
[1] https://github.com/substack/safe-regex https://github.com/substack/safe-regex
- franciscop 10y agoThe path is preferred to the Regex, and I hope that no developer is using user input to create a route here. As specified in substack's safe-regex: > WARNING: This module merely seems to work given all the catastrophic regular expressions I could find scouring the internet, but I don't have enough of a background in automata to be absolutely sure that this module will catch all exponential-time cases. I also don't have it and I think the case for this error is so contrieved that it doesn't make sense to add a check in pagex. So adding a couple of warnings, one for not trusting user input and another for this specific error, should be fine.
- SwellJoe 10y agoIsn't this client-side? So, what could a malicious user DoS other than their own browser? Am I missing something?