JS/PY/RB: support a limited number of ranges for ReDoS analysis #7097
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
erik-krogh
force-pushed
the
railsReDoS
branch
2 times, most recently
from
0e37892 to
a983693
Compare
erik-krogh
changed the title
erik-krogh
force-pushed
the
railsReDoS
branch
from
a983693 to
aee9c03
Compare
nickrolfe
reviewed
Nov 11, 2021
nickrolfe
previously approved these changes
Nov 25, 2021
yoff
reviewed
Nov 30, 2021
Comment on lines
101
to
102
| import RegExpTreeView | ||
|
|
Contributor
There was a problem hiding this comment.
Is this not a repetition of line 86?
Contributor
Author
There was a problem hiding this comment.
It is.
I'll remove the redundancy.
Contributor
Author
|
I've rebased this PR on main. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The idea of this PR is that
/a{0,100}/is close enough to/a*/that we can just treat them the same.Gets us one step closer to flagging CVE-2021-22902.
Evaluations: Ruby, Python, JavaScript look OK.
The JavaScript evaluation shows that an FP was fixed.