Merge pull request #180 from ChALkeR/chalker/fix-style

LinusU · web-flow · commit 22c6b768a16e · 2020-06-29T20:56:42.000+02:00
Fix a ReDoS in 'style' format
diff --git a/formats.js b/formats.js
@@ -28,7 +28,7 @@ exports['hostname'] = function (input) {
 }
 exports['alpha'] = /^[a-zA-Z]+$/
 exports['alphanumeric'] = /^[a-zA-Z0-9]+$/
-exports['style'] = /\s*(.+?):\s*([^;]+);?/g
+exports['style'] = /.:\s*[^;]/g
 exports['phone'] = function (input) {
   if (!(rePhoneFirstPass.test(input))) return false
   if (rePhoneDoubleSpace.test(input)) return false

Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ exports['hostname'] = function (input) {`
`28`	`28`	`}`
`29`	`29`	`exports['alpha'] = /^[a-zA-Z]+$/`
`30`	`30`	`exports['alphanumeric'] = /^[a-zA-Z0-9]+$/`
`31`		`-exports['style'] = /\s(.+?):\s([^;]+);?/g`
	`31`	`+exports['style'] = /.:\s*[^;]/g`
`32`	`32`	`exports['phone'] = function (input) {`
`33`	`33`	`if (!(rePhoneFirstPass.test(input))) return false`
`34`	`34`	`if (rePhoneDoubleSpace.test(input)) return false`