fix: escape $ character in regex to prevent injection#44638
fix: escape $ character in regex to prevent injection#44638joestringer merged 1 commit intocilium:mainfrom
Conversation
joestringer
left a comment
There was a problem hiding this comment.
Fix looks good, just a couple of trivial things picked up by one of the linters.
|
It looks like we use this workflow pinned to the versions in specific release branches. I've added the backport labels. |
|
/test |
@aanm do you recall why we do this? Should we just switch the |
2d640a1 to
6e6a714
Compare
Corrected the regular expression by properly escaping the $ character to ensure literal matching: Before: .replace(/$g, '') After: .replace(/\$/g, '') Reported-by: Vikram <vikram@cure53.de> Reported-by: Youssef Abdullah Al-Otaibi <u4@hotmail.com> Signed-off-by: Peter Oyekunle <poyekunl@cisco.com>
6e6a714 to
dba7f3b
Compare
|
/test |
|
`> > It looks like we use this workflow pinned to the versions in specific release branches. I've added the backport labels.
@joestringer No.
I don't think so, we need to handle the events for each specific branch. The |
|
Smoke test failures are unrelated to the code being modified here, and they represent a known issue when mixing a PR based on an older commit against the newer CI. I'll bypass that to merge. |
Corrected the regular expression by properly escaping the $ character to ensure literal matching:
This PR fixes a vulnerability in the regular expression where the
$character was not properly escaped, causing it to match end-of-string positions instead of literal$characters.Before: .replace(/$g, '')
After: .replace(/$/g, '')
Reported-By: Vikram vikram@cure53.de
Reported-By: Youssef Abdullah Al-Otaibi u4@hotmail.com
Signed-off-by: Peter Oyekunle poyekunl@cisco.com