RealDevSquad / RealDevSquad/website-backend
Solution to github Warning: Unsafe Regular Expression
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 74
- Forks
- 276
- Avg merge
- 1d 26m
- Merged PRs (30d)
- 14
Description
Issue: Github shows a warning for an unsafe regular expression on our config files for Cors regex
Reason
We are getting this warning as the regex that we have added is an open-end regex i.e. it can lead to many permutations of our websites.
let's say xyz.realdevsquad.com will also match the specified regex similarly many other combinations will sit.
This is not a good way of specifying allowed websites for CORS.
We need to have more strict validation for the allowed websites.
Resolution
To solve this we can provide an array of allowed websites which is supported by cors middleware. Read more here: https://www.npmjs.com/package/cors#configuring-cors-w-dynamic-origin
once this is set we will get rid of the unsafe regular expression warning.
Please write tests for it as well.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the CORS regular expression in the config files and read the cors middleware documentation linked in the issue. Replace the open-ended origin pattern with an explicit allowed-websites array, add tests for the permitted and rejected origins, and run the relevant test suite to confirm the unsafe-regex warning is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100