RealDevSquad / RealDevSquad/website-backend

Solution to github Warning: Unsafe Regular Expression

Open
#1,289 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
74
Forks
276
Avg merge
1d 26m
Merged PRs (30d)
14

Description

Issue: Github shows a warning for an unsafe regular expression on our config files for Cors regex

Reason
We are getting this warning as the regex that we have added is an open-end regex i.e. it can lead to many permutations of our websites.
let's say xyz.realdevsquad.com will also match the specified regex similarly many other combinations will sit.
This is not a good way of specifying allowed websites for CORS.
We need to have more strict validation for the allowed websites.

Resolution
To solve this we can provide an array of allowed websites which is supported by cors middleware. Read more here: https://www.npmjs.com/package/cors#configuring-cors-w-dynamic-origin

once this is set we will get rid of the unsafe regular expression warning.

Please write tests for it as well.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the CORS regular expression in the config files and read the cors middleware documentation linked in the issue. Replace the open-ended origin pattern with an explicit allowed-websites array, add tests for the permitted and rejected origins, and run the relevant test suite to confirm the unsafe-regex warning is resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
api, backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.