cloudflare / cloudflare/telescope

RegExp used in route matching can cause false positives

Open
#134 0 comments 0 reactions 0 assignees View on GitHub
ticket
Dominant language
TypeScript
Stars
305
Forks
36
PR merge metrics
No merged PRs in 30d

Description

We currently generate RegExp strings for matching routes in a few places in the codebase.

For example we concatenate host names separated by '|' to match multiple hostnames.
Or we prefix the host with `//` to match URL hostnames.
Or just use user input as a regex.

- These strings might be inaccurate as substrings and regexes are not the same, for example
- Those strings might actually be invalid and throw exceptions
- They might not be particularly secure if user input might cause some bad behavior in RegExp (this is speculation)

Evaluate the risk and replace with functional matching and wrap remaining RegEx instances in `try / catch` block to provide better context.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.