Commit ac9cba5
committed
RMB-1046: Avoid regex in .replaceAll(" +[*]", "")
https://folio-org.atlassian.net/browse/RMB-1046
Sonar reports:
https://sonarcloud.io/project/security_hotspots?id=org.folio%3Araml-module-builder&hotspots=AX9uQp8Uu74XD50_RGf1
> Make sure the regex used here, which is vulnerable to polynomial runtime due to backtracking, cannot lead to denial of service.
>
> Using slow regular expressions is security-sensitive
>
> java:S5852 https://sonarcloud.io/organizations/folio-org/rules?open=java%3AS5852&rule_key=java%3AS5852
Code:
https://github.com/folio-org/raml-module-builder/blob/v35.4.0/cql2pgjson/src/main/java/org/folio/cql2pgjson/CQL2PgJSON.java#L831
> .replaceAll(" +[*]", "")
Task:
Use `.replace(" *", " ")` instead.
This completely avoids using a regex.1 parent 53c01dd commit ac9cba5
2 files changed
Lines changed: 3 additions & 1 deletion
File tree
- cql2pgjson/src
- main/java/org/folio/cql2pgjson
- test/java/org/folio/cql2pgjson
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
828 | 828 | | |
829 | 829 | | |
830 | 830 | | |
831 | | - | |
| 831 | + | |
832 | 832 | | |
833 | 833 | | |
834 | 834 | | |
| |||
Lines changed: 2 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
936 | 936 | | |
937 | 937 | | |
938 | 938 | | |
| 939 | + | |
| 940 | + | |
939 | 941 | | |
940 | 942 | | |
941 | 943 | | |
| |||
0 commit comments