Skip to content

fix: prevent ReDoS in URL regex pattern #15531

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from

Conversation

bbonillachavez
Copy link

@bbonillachavez bbonillachavez commented Apr 11, 2025

Description

This PR updates the URL validation regex in foundation.abide.js to address the ReDoS vulnerability. I plugged the new regex into -- https://regexr.com/ -- and made sure it matched the same cases as the old one. I used this ReDoS checker -- https://devina.io/redos-checker -- to ensure that the new regex wasn't vulnerable.

Types of changes

  • Documentation
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (anything that would change an existing functionality)
  • Maintenance (refactor, code cleaning, development tools...)

Checklist

  • I have read and follow the CONTRIBUTING.md document.
  • The pull request title and template are correctly filled.
  • The pull request targets the right branch (develop or develop-v...).
  • My commits are correctly titled and contain all relevant information.
  • I have updated the documentation accordingly to my changes (if relevant).
  • I have added tests to cover my changes (if relevant).

@bbonillachavez bbonillachavez marked this pull request as ready for review April 14, 2025 18:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Security Issue: Request for contact
1 participant