Skip to content

Commit

Permalink
[bugfix] Fix redos in preprocessRFC2822 regex (#6015)
Browse files Browse the repository at this point in the history
* fix ReDoS in preprocessRFC2822 regex

Fixes: [#2936](#6012)

Disallow nested rfc2822 comments to prevent quadratic regex execution time (i.e each open bracket is considered at most twice).
  • Loading branch information
vovikhangcdv authored and ichernev committed Jul 6, 2022
1 parent 6374fd8 commit 9a3b589
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/lib/create/from-string.js
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@ function untruncateYear(yearStr) {
function preprocessRFC2822(s) {
// Remove comments and folding whitespace and replace multiple-spaces with a single space
return s
.replace(/\([^)]*\)|[\n\t]/g, ' ')
.replace(/\([^()]*\)|[\n\t]/g, ' ')
.replace(/(\s\s+)/g, ' ')
.replace(/^\s\s*/, '')
.replace(/\s\s*$/, '');
Expand Down

0 comments on commit 9a3b589

Please sign in to comment.