🎉 This PR is included in version 10.3.5 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

@achingbrain see ChainSafe/lodestar#4689

is-ip 5.0.0 is significantly slower due to wrapping the regex call in the super-regex library.
Recommendation to revert this PR or roll our own dependency.

If we need better protection against regex DoS, we should be able to limit the input string in some ways without resorting to nifty but slow techniques like super-regex.

I've opened sindresorhus/is-ip#14

If we need better protection against regex DoS, we should be able to limit the input string in some ways without resorting to nifty but slow techniques

Unfortunately from experience, this is not always enough. A malicious input could make the regex crawl to a halt in 20 characters.

I'm the author of is-ip. I'm happy to add an option to skip super-regex, but I think you want the ReDoS protection. I'm open to other ideas.

Alternatively, you can just use ip-regex package directly.

Hey @sindresorhus thanks for replying :)

We def don't want to be vulnerable to DoS attacks. But we also are running into performance issues with the current approach.

Some possible directions:

• If we can determine that there are some uses of is-ip that are trusted / we know won't pass in malicious input. We could use regex and skip the call to super-regex.

• If we can use or build something less generic than regex that doesn't have the same worst-case properties.
  Eg: rust std has a custom parser to parse IP addrs from strings: https://doc.rust-lang.org/src/std/net/parser.rs.html#36

• use net.isIP?