File tree 2 files changed +30
-1
lines changed
2 files changed +30
-1
lines changed Original file line number Diff line number Diff line change @@ -6,7 +6,7 @@ var FN_ARGS = /^(?:async\s+)?(?:function)?\s*\w*\s*\(\s*([^)]+)\s*\)(?:\s*{)/;
6
6
var ARROW_FN_ARGS = / ^ (?: a s y n c \s + ) ? \( ? \s * ( [ ^ ) = ] + ) \s * \) ? (?: \s * = > ) / ;
7
7
var FN_ARG_SPLIT = / , / ;
8
8
var FN_ARG = / ( = .+ ) ? ( \s * ) $ / ;
9
- var STRIP_COMMENTS = / ( ( \/ \/ . * $ ) | ( \/ \* [ \s \S ] * ? \* \/ ) ) / mg;
9
+ var STRIP_COMMENTS = / ( \/ \* (?: [ ^ / ] | \/ (? ! \* ) ) * \* \/ ) | \/ \/ . * $ / mg;
10
10
11
11
function parseParams ( func ) {
12
12
const src = func . toString ( ) . replace ( STRIP_COMMENTS , '' ) ;
Original file line number Diff line number Diff line change @@ -224,4 +224,33 @@ describe('autoInject', () => {
224
224
done ( )
225
225
} )
226
226
} )
227
+
228
+ it ( 'should not be subject to ReDoS' , ( ) => {
229
+ // This test will timeout if the bug is present.
230
+ var someComments = 'text/*' . repeat ( 1000000 )
231
+ expect ( ( ) => async . autoInject ( {
232
+ someComments,
233
+ a ( ) { }
234
+ } ) ) . to . throw ( )
235
+ } ) ;
236
+
237
+ it ( 'should properly strip comments in argument definitions' , ( done ) => {
238
+ async . autoInject ( {
239
+ task1 : function ( task2 , /* ) */ callback ) {
240
+ callback ( null , true ) ;
241
+ } ,
242
+ task2 : function task2 ( task3 // )
243
+ , callback ) {
244
+ callback ( null , true ) ;
245
+ } ,
246
+ task3 : function task3 ( callback ) {
247
+ callback ( null , true ) ;
248
+ }
249
+ } ,
250
+ ( err , result ) => {
251
+ expect ( err ) . to . eql ( null ) ;
252
+ expect ( result ) . to . deep . eql ( { task1 : true , task2 : true , task3 : true } ) ;
253
+ done ( ) ;
254
+ } ) ;
255
+ } ) ;
227
256
} ) ;
You can’t perform that action at this time.
0 commit comments