Skip to content

fix: mitigate ReDoS when generating examples from pattern#10477

Merged
glowcloud merged 4 commits intomasterfrom
fix-redos
Jun 3, 2025
Merged

fix: mitigate ReDoS when generating examples from pattern#10477
glowcloud merged 4 commits intomasterfrom
fix-redos

Conversation

@glowcloud
Copy link
Copy Markdown
Contributor

No description provided.

export const randexp = (pattern) => {
try {
const randexpInstance = new RandExp(pattern)
const safeRegex = /(?<=\{[^}]*)\d{3,}(?=[^}]*\})/g
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/(?<!\\)(?<=\{[^}]*)\d{3,}(?=[^}]*\}(?!\\))/g - this should cover for the case of having the brackes escaped, which basically creates a stream of characters instead of control structure for regular expression.

* 3. {,x}
* 4. {x,y}
*/
const safeRegex =
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The highlighted examples are what will be matched by this pattern:

regex

Comment thread src/core/plugins/json-schema-2020-12-samples/fn/core/random.js
@glowcloud glowcloud merged commit 71c9314 into master Jun 3, 2025
8 checks passed
@glowcloud glowcloud deleted the fix-redos branch June 3, 2025 08:44
delendik-testops pushed a commit to ModiusOpenData/swagger-ui that referenced this pull request Mar 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants