moxystudio/node-cross-spawnPublic

NotificationsYou must be signed in to change notification settings
Fork137
Star1.2k

fix: disable regexp backtracking#160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

satazor merged 1 commit intomasterfrombugfix/regexp-backtrack

Nov 6, 2024

Merged

fix: disable regexp backtracking#160

satazor merged 1 commit intomasterfrombugfix/regexp-backtrack

Nov 6, 2024

+4 −2

Conversation

Copy link

Contributor

satazor commentedNov 6, 2024

With a very large and well crafted string, the escaping made by cross-spawn hangs forever.

const{ argument}=require('cross-spawn/lib/util/escape');varstr="";for(vari=0;i<1000000;i++){str+="\\";}str+="◎";console.log("start")argument(str)console.log("end")

This PR disables regexp back tracking so that it doesn't suffer from this.https://javascript.info/regexp-catastrophic-backtracking for more details.

fix: disable regexp backtracking

6337cca

satazor force-pushed thebugfix/regexp-backtrack branch from99d1c1c to6337ccaCompare

November 6, 2024 09:06

satazor merged commit5ff3a07 intomaster

Nov 6, 2024

1 check passed

satazor added a commit that referenced this pull request

Nov 7, 2024

Revert "fix: disable regexp backtracking (#160)"

31c1712

This reverts commit5ff3a07.

satazor mentioned this pull request

Nov 7, 2024

fix: fix escaping bug introduced by backtracking#162

Merged

satazor deleted the bugfix/regexp-backtrack branch

November 7, 2024 13:04

satazor added a commit that referenced this pull request

Nov 18, 2024

fix: disable regexp backtracking (#160)

ba5aaef

Scc33 mentioned this pull request

Nov 18, 2024

CVE-2024-21538 | Regular Expression Denial of Service (ReDoS) in cross-spawn | Version Fixed?#167

Open

This was referencedNov 19, 2024

chore(deps): updatecross-spawn to v7.0.6yarnpkg/berry#6605

Closed

chore: unlock cross-spawn rangeyarnpkg/berry#6606

Merged

Thompson1985 approved these changes

Nov 20, 2024

View reviewed changes

folortin mentioned this pull request

Nov 21, 2024

[Security] ReDoS vulnerabilitynpm/cli#7927

Closed

This was referencedDec 9, 2024

Fix CVE–2024–21538Moldy-Crow/Uptime_Kuma_Test#2

Merged

Fix CVE–2024–21538Moldy-Crow/Uptime_Kuma_Test#3

Merged

debrickedbot mentioned this pull request

Dec 19, 2024

Fix CVE–2024–21538Moldy-Crow/Uptime_Kuma_Test#4

Merged

This was referencedJan 7, 2025

High/Critical Vulnerabilities Found on latest buildgknguyen/backend-node-service#8

Closed

High/Critical Vulnerabilities Found on latest buildgknguyen/backend-node-service#9

Closed

This was referencedJan 17, 2025

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#10

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#24

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#27

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#28

Open

High severity - Regular Expression Denial of Service (ReDoS) vulnerability in cross-spawn (package.json)pickford-snyk/nodejs-goof#114

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#37

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#39

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#41

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#43

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#47

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#48

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#49

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#50

Open

This was referencedJan 23, 2025

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#51

Open

Security: cross-spawn 7.0.3 has HIGH vulnerabilitymeido-ai/devdb#56

Open

This was referencedJan 28, 2025

fix(deps): update cross-spawn from 7.0.3 → 7.0.5CyberdyneHQ/phaser#11

Open

fix(deps): update cross-spawn from 7.0.3 → 7.0.6CyberdyneHQ/phaser#12

Open

fix(deps): update eslint from 8.56.0 → 9.19.0CyberdyneHQ/phaser#14

Open

debrickedbot mentioned this pull request

Feb 4, 2025

Fix CVE–2024–21538AppiLia/juice-shop#1

Merged

This was referencedFeb 10, 2025

fix(deps): update npm/eslint from 8.56.0 → 9.19.0anto-deepsource/phaser#8

Open

fix(deps): update npm/eslint from 8.56.0 → 9.19.0anto-deepsource/phaser#9

Open

fix(deps): update npm/eslint from 8.56.0 → 9.20.0anto-deepsource/phaser#10

Open

fix(deps): update npm/eslint from 8.56.0 → 9.20.0anto-deepsource/phaser#11

Open

fix(deps): update npm/eslint from 8.56.0 → 9.20.0anto-deepsource/phaser#12

Open

fix(deps): update npm/eslint from 8.56.0 → 9.20.0anto-deepsource/phaser#13

Open

fix(deps): update npm/cross-spawn from 7.0.3 → 7.0.5NewProfoundOrigin/phaser#3

Open

fix(deps): update npm/eslint from 8.56.0 → 9.20.0NewProfoundOrigin/phaser#4

Open

fix(deps): update npm/cross-spawn from 7.0.3 → 7.0.5NewProfoundOrigin/phaser#10

Open

gurus00 pushed a commit to gurus00/node-cross-spawn that referenced this pull request

Feb 11, 2025

fix: disable regexp backtracking (moxystudio#160)

33bca0b

deepsource-devbot mentioned this pull request

Feb 13, 2025

fix(deps): update npm/cross-spawn from 7.0.3 → 7.0.5anto-deepsource/phaser#14

Open

pratheeshrussell-qb mentioned this pull request

Feb 20, 2025

Testpratheeshrussell-qb/docker_vuln_scan#8

Closed

github-actionsbot mentioned this pull request

Feb 25, 2025

High/Critical Vulnerabilities Found on latest buildgknguyen/backend-node-service#17

Closed

pratheeshrussell-qb mentioned this pull request

Apr 7, 2025

Testpratheeshrussell-qb/docker_vuln_scan#9

Closed

github-actionsbot mentioned this pull request

Apr 7, 2025

Test2pratheeshrussell-qb/docker_vuln_scan#10

Open

This was referencedApr 11, 2025

fix(deps): update npm/cross-spawn from 7.0.3 → 7.0.5CyberdyneHQ/phaser#21

Open

fix(deps): update npm/eslint from 8.56.0 → 9.24.0CyberdyneHQ/phaser#22

Open

deepsource-devbot mentioned this pull request

Apr 25, 2025

fix(deps): update npm/cross-spawn from 7.0.3 → 7.0.5CyberdyneHQ/phaser#31

Open

This was referencedMay 8, 2025

Update cross-spawn to version 7.0.6patriknordlen/mob-time#116

Closed

Update cross-spawn to version 7.0.6patriknordlen/mob-time#121

Closed

Update cross-spawn to version >= 7.0.5, 6.0.6patriknordlen/mob-time#133

Closed

Update cross-spawn to version >= 7.0.5, 6.0.6patriknordlen/mob-time#137

Closed

github-actionsbot mentioned this pull request

Jun 21, 2025

chore(deps): bump cross-spawn from 7.0.3 to 7.0.6korosuke613/homepage-2nd#1077

Merged

gardera-securitybot mentioned this pull request

Oct 14, 2025

Update cross-spawn from version 7.0.3 to version 7.0.5patriknordlen/mob-time#143

Open

Labels

None yet

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: disable regexp backtracking#160

fix: disable regexp backtracking#160

Conversation

satazor commentedNov 6, 2024

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants