Skip to content

Commit 0cd795d

Browse files
authored
fix(security): ensure wiki sidebar generation isn't vulnerable to regex backtracking (#92)
The regex pattern to match ## or ### was initially vulnerable to potential DOS backtracking via the ".+" pattern. This fix prevents that by using a different character group matching pattern.
1 parent 57fdadb commit 0cd795d

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

src/wiki.ts

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,10 @@ async function generateWikiSidebar(terraformModules: TerraformModule[]): Promise
293293
const changelogContent = getModuleReleaseChangelog(module);
294294

295295
// Regex to capture all headings starting with '## ' on a single line
296-
const headingRegex = /^(?:#{2,3})\s+(.+)$/gm; // Matches '##' or '###' headings
296+
// Note: Use ([^\n]+) Instead of (.+):
297+
// The pattern [^\n]+ matches one or more characters that are not a newline. This restricts matches
298+
// to a single line and reduces backtracking possibilities since it won't consume any newlines.
299+
const headingRegex = /^(?:#{2,3})\s+([^\n]+)/gm; // Matches '##' or '###' headings
297300

298301
// Initialize changelog entries
299302
const changelogEntries = [];

0 commit comments

Comments
 (0)