New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

the regex failed vulnerability check ? #46

Open

xiuqingli opened this issue Jan 20, 2020 · 1 comment

xiuqingli commented Jan 20, 2020

I did a vulnerability test of the regex.

it failed in https://www.npmjs.com/package/safe-regex
'Invalid' in https://www.npmjs.com/package/vuln-regex-detector, I don't know why it's invalid, will follow up.

Should I worry about the vulnerability of the regex used in the package?

Thanks!

Alan-Liang commented Feb 20, 2021

It's a bit late to reply, but I found that

safe-regex is false positive on this regex because it has nested repetitions while it is actually safe.
vuln-regex-detector reports everything as invalid as the server is down (Error: connect ETIMEDOUT davisjam/vuln-regex-detector#72). Doing real testing by executing the perl script directly reports the regex as safe.

Disclaimer: I'm not a security expert.

josecelano mentioned this issue

Fix security issue with regexp for email validation nautilus-cyberneering/git-queue#264

Merged

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment