cloudflare / cloudflare/telescope
RegExp used in route matching can cause false positives
- Dominant language
- TypeScript
- Stars
- 305
- Forks
- 36
- PR merge metrics
- No merged PRs in 30d
Description
We currently generate RegExp strings for matching routes in a few places in the codebase.
For example we concatenate host names separated by '|' to match multiple hostnames.
Or we prefix the host with `//` to match URL hostnames.
Or just use user input as a regex.
- These strings might be inaccurate as substrings and regexes are not the same, for example
- Those strings might actually be invalid and throw exceptions
- They might not be particularly secure if user input might cause some bad behavior in RegExp (this is speculation)
Evaluate the risk and replace with functional matching and wrap remaining RegEx instances in `try / catch` block to provide better context.
Contributor guide
Assessment
This issue has not been assessed yet.