Skip to content

Commit cdfb491

Browse files
meekdenzoTrott
andauthoredDec 2, 2021
Fix an inefficient regex in autoInject (#1767)
* Fix an inefficient regex in autoInject * 'properly strip comments in argument definitions' test failure * Update test/autoInject.js Co-authored-by: Rich Trott <rtrott@gmail.com> * Update on url-comments lib/autoInject.js Co-authored-by: Rich Trott <rtrott@gmail.com> * move new tests test/autoInject.js * indentation fix test/autoInject.js Co-authored-by: Rich Trott <rtrott@gmail.com>
1 parent bb41f2a commit cdfb491

File tree

2 files changed

+30
-1
lines changed

2 files changed

+30
-1
lines changed
 

‎lib/autoInject.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ var FN_ARGS = /^(?:async\s+)?(?:function)?\s*\w*\s*\(\s*([^)]+)\s*\)(?:\s*{)/;
66
var ARROW_FN_ARGS = /^(?:async\s+)?\(?\s*([^)=]+)\s*\)?(?:\s*=>)/;
77
var FN_ARG_SPLIT = /,/;
88
var FN_ARG = /(=.+)?(\s*)$/;
9-
var STRIP_COMMENTS = /((\/\/.*$)|(\/\*[\s\S]*?\*\/))/mg;
9+
var STRIP_COMMENTS = /(\/\*(?:[^/]|\/(?!\*))*\*\/)|\/\/.*$/mg;
1010

1111
function parseParams(func) {
1212
const src = func.toString().replace(STRIP_COMMENTS, '');

‎test/autoInject.js

+29
Original file line numberDiff line numberDiff line change
@@ -224,4 +224,33 @@ describe('autoInject', () => {
224224
done()
225225
})
226226
})
227+
228+
it('should not be subject to ReDoS', () => {
229+
// This test will timeout if the bug is present.
230+
var someComments = 'text/*'.repeat(1000000)
231+
expect(() => async.autoInject({
232+
someComments,
233+
a () {}
234+
})).to.throw()
235+
});
236+
237+
it('should properly strip comments in argument definitions', (done) => {
238+
async.autoInject({
239+
task1: function(task2, /* ) */ callback) {
240+
callback(null, true);
241+
},
242+
task2: function task2(task3 // )
243+
,callback) {
244+
callback(null, true);
245+
},
246+
task3: function task3(callback) {
247+
callback(null, true);
248+
}
249+
},
250+
(err, result) => {
251+
expect(err).to.eql(null);
252+
expect(result).to.deep.eql({task1: true, task2: true, task3: true});
253+
done();
254+
});
255+
});
227256
});

0 commit comments

Comments
 (0)