Skip to content

Make sure the regex used here, which is vulnerable to super-linear runtime due to backtracking, cannot lead to denial of service. #354

Description

@jvigliotta

Describe the sustaining activity

src/persistence/BaseMCWSPersistenceProvider.js

import mcws from '../services/mcws/mcws';
import { createModelFromNamespaceDefinitionWithPersisted, interpolateUsername } from './utils';
const USERNAME_FROM_PATH_REGEX = new RegExp('.*/(.*?)$');
// Make sure the regex used here, which is vulnerable to super-linear runtime due to backtracking, cannot lead to denial of service.

/**
 * An object defining a MCWS namespace.  Provides a unique identifier for a
 * MCWS namespace and all the information necessary to access it.
 *

AND

src/services/dataset/Dataset.js

    }
    return url;
  };
  Dataset.prototype.omitsDictionaryVersion = function (url) {
    return /\/.*Dictionary\/?$/.test(url);
// Make sure the regex used here, which is vulnerable to super-linear runtime due to backtracking, cannot lead to denial of service.

  };
  /**
   * Returns the urlType
   * eg

Expected behavior

Testing Instructions
1.

Additional context

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions