ajv-validator / ajv-validator/ajv-formats
Use 're2' package to prevent ReDoS?
- Lingua principale
- TypeScript
- Stelle
- 228
- Fork
- 42
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
According to the [Ajv documentation](https://github.com/ajv-validator/ajv/blob/bd8d86579386cb58854e9db74a5dc7b2d1894806/docs/security.md#redos-attack):
> some formats that ajv-formats package implements use regular expressions that can be vulnerable to ReDoS attack
Having you considered using the [`re2`](https://www.npmjs.com/package/re2) package to eliminate this risk? According to its [documentation](https://github.com/google/re2/wiki/WhyRE2):
> RE2 was designed and implemented with an explicit goal of being able to handle regular expressions from untrusted users without risk. One of its primary guarantees is that the match time is linear in the length of the input string.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Valutazione
Questa issue non è ancora stata valutata.