Skip to content

Commit 9f97f98

Browse files
Revert "fix(urlMatcher): Fix potential ReDoS, thanks to www.HeroDevs.com"
This reverts commit 0db52a1.
1 parent 0db52a1 commit 9f97f98

File tree

1 file changed

+6
-7
lines changed

1 file changed

+6
-7
lines changed

src/url/urlMatcher.ts

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -234,14 +234,13 @@ export class UrlMatcher {
234234
// The regular expression is somewhat complicated due to the need to allow curly braces
235235
// inside the regular expression. The placeholder regexp breaks down as follows:
236236
// ([:*])([\w\[\]]+) - classic placeholder ($1 / $2) (search version has - for snake-case)
237-
// \{([\w\[\]]+)(?:\: ... ( ... ))?\} - curly brace placeholder ($3) with optional regexp/type ... ($5) (search version has - for snake-case
237+
// \{([\w\[\]]+)(?:\:\s*( ... ))?\} - curly brace placeholder ($3) with optional regexp/type ... ($4) (search version has - for snake-case
238238
// (?: ... | ... | ... )+ - the regexp consists of any number of atoms, an atom being either
239-
// [^{}\\] - anything other than curly braces or backslash
239+
// [^{}\\]+ - anything other than curly braces or backslash
240240
// \\. - a backslash escape
241-
// \{(?:[^{}\\]|\\.)*\} - a matched set of curly braces containing other atoms
242-
const placeholder = /([:*])([\w\[\]]+)|\{([\w\[\]]+)(?:\:(?=(\s*))\4((?:[^{}\\]|\\.|\{(?:[^{}\\]|\\.)*\})+))?\}/g;
243-
const searchPlaceholder =
244-
/([:]?)([\w\[\].-]+)|\{([\w\[\].-]+)(?:\:(?=(\s*))\4((?:[^{}\\]|\\.|\{(?:[^{}\\]|\\.)*\})+))?\}/g;
241+
// \{(?:[^{}\\]+|\\.)*\} - a matched set of curly braces containing other atoms
242+
const placeholder = /([:*])([\w\[\]]+)|\{([\w\[\]]+)(?:\:\s*((?:[^{}\\]+|\\.|\{(?:[^{}\\]+|\\.)*\})+))?\}/g;
243+
const searchPlaceholder = /([:]?)([\w\[\].-]+)|\{([\w\[\].-]+)(?:\:\s*((?:[^{}\\]+|\\.|\{(?:[^{}\\]+|\\.)*\})+))?\}/g;
245244
const patterns: any[][] = [];
246245
let last = 0;
247246
let matchArray: RegExpExecArray;
@@ -257,7 +256,7 @@ export class UrlMatcher {
257256
const matchDetails = (m: RegExpExecArray, isSearch: boolean): MatchDetails => {
258257
// IE[78] returns '' for unmatched groups instead of null
259258
const id: string = m[2] || m[3];
260-
const regexp: string = isSearch ? m[5] : m[5] || (m[1] === '*' ? '[\\s\\S]*' : null);
259+
const regexp: string = isSearch ? m[4] : m[4] || (m[1] === '*' ? '[\\s\\S]*' : null);
261260

262261
const makeRegexpType = (str) =>
263262
inherit(paramTypes.type(isSearch ? 'query' : 'path'), {

0 commit comments

Comments
 (0)