Skip to content

Commit f923116

Browse files
authored
fix: eliminate ReDoS (#36)
This change fixes a regular expression denial of service vulnerability. Refs: #32 Refs: https://app.snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
1 parent 0b014a7 commit f923116

File tree

2 files changed

+8
-1
lines changed

2 files changed

+8
-1
lines changed

index.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ var isWin32 = require('os').platform() === 'win32';
66

77
var slash = '/';
88
var backslash = /\\/g;
9-
var enclosure = /[\{\[].*[\/]*.*[\}\]]$/;
9+
var enclosure = /[\{\[].*[\}\]]$/;
1010
var globby = /(^|[^\\])([\{\[]|\([^\)]+$)/;
1111
var escaped = /\\([\!\*\?\|\[\]\(\)\{\}])/g;
1212

test/index.test.js

+7
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,13 @@ describe('glob2base test patterns', function() {
209209

210210
done();
211211
});
212+
213+
it('should not be susceptible to SNYK-JS-GLOBPARENT-1016905', function(done) {
214+
// This will time out if susceptible.
215+
gp('{' + '/'.repeat(5000));
216+
217+
done();
218+
});
212219
});
213220

214221
if (isWin32) {

0 commit comments

Comments
 (0)