Merge pull request #4 from Woorank/redos

Mitigate against Redos
Woorank · Feb 7, 2021 · c03827c · c03827c
2 parents 491ecd5 + feba68e
commit c03827c
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 3 deletions.
diff --git a/lib/patterns.js b/lib/patterns.js
@@ -38,7 +38,7 @@ exports.path = function makePathPattern (pattern) {
   const specificityString = pattern.replace(/\*/g, '');
 
   pattern = pattern
-    .split('*')
+    .split(/\*+/)
     .map(escapeRegExp)
     .join('(?:.*)');
 

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "robots-txt-guard",
-  "version": "0.2.1",
+  "version": "1.0.0",
   "description": "Validate urls against robots.txt rules.",
   "main": "lib/guard.js",
   "repository": {

diff --git a/test/patterns.spec.js b/test/patterns.spec.js
@@ -150,5 +150,10 @@ describe('patterns', function () {
 
       assertNoMatch(pattern, '/Fish.PHP');
     });
+
+    it('should handle a ReDos', function () {
+      const pattern = patterns.path('/*****************************************************************************.js$');
+      assertMatch(pattern, '/hello.js');
+    });
   });
 });