Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Core: fix ReDoS vulnerability in url2#2428

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
bytestream merged 1 commit intomasterfromredos
May 19, 2022
Merged

Core: fix ReDoS vulnerability in url2#2428

bytestream merged 1 commit intomasterfromredos
May 19, 2022

Conversation

bytestream
Copy link
Member

@bytestreambytestream commentedMay 19, 2022
edited by staabm
Loading

ReDoS, or Regular Expression Denial of Service, is a vulnerability affecting poorly constructed and potentially inefficient regular expressions which can make them perform extremely badly given a creatively constructed input string.

Updated regex to matchurl validation, but adjusted to allow optional TLD.

reported by Shachar Menashe
research team at JFrog Security

@bytestreambytestream requested a review fromstaabmMay 19, 2022 15:16
@staabm
Copy link
Member

thanks!

@bytestreambytestream merged commit69cb17e intomasterMay 19, 2022
@bytestreambytestream deleted the redos branchMay 19, 2022 15:20
@ffontaine
Copy link
Contributor

FYI, it seems this issue has been assignedCVE-2021-43306

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@staabmstaabmstaabm approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

3 participants
@bytestream@staabm@ffontaine

[8]ページ先頭

©2009-2025 Movatter.jp