ajv-validator / ajv-validator/ajv-formats
Use 're2' package to prevent ReDoS?
- 主要言語
- TypeScript
- スター
- 228
- フォーク
- 42
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
According to the [Ajv documentation](https://github.com/ajv-validator/ajv/blob/bd8d86579386cb58854e9db74a5dc7b2d1894806/docs/security.md#redos-attack):
> some formats that ajv-formats package implements use regular expressions that can be vulnerable to ReDoS attack
Having you considered using the [`re2`](https://www.npmjs.com/package/re2) package to eliminate this risk? According to its [documentation](https://github.com/google/re2/wiki/WhyRE2):
> RE2 was designed and implemented with an explicit goal of being able to handle regular expressions from untrusted users without risk. One of its primary guarantees is that the match time is linear in the length of the input string.
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
評価
この issue はまだ評価されていません。