[Security advisory]: Regular Expression Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

[ShiyuBanzhou]

What happened?

My security advisor url is here:GHSA-h5c3-5r3r-rr8q
Resolves: #Solution

Versions

@octokit/plugin-paginate-rest >=v1.0.0

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[wolfy1339]

Please do not post security vulnerabilities publicly. Please follow the proper disclosure process at
https://github.com/github/.github/blob/main/SECURITY.md#reporting-security-issues

[ShiyuBanzhou]

Hello @wolfy1339 ,
I understand your point, so all the links I provided above are private and can only be viewed by your team. The reason I submitted a public issue is that two weeks ago, I had already submitted a related issue in your other project’s endpoint, but it has not yet been addressed. I mistakenly thought that submitting a public issue would serve as a reminder for you to handle it promptly. I apologize if this caused any inconvenience or gave the impression of rushing you, that was never my intention. If you have any concerns, please feel free to contact me. My only goal is to help make your project more robust and secure. I look forward to hearing from you, and it would be greatly appreciated if you could let me know when the issue might be resolved. In fact, I’ve already sent a notification to the designated email following the security notice, but I haven’t received any response yet, and it’s been a month.
Thank you for your understanding, and I look forward to your reply.

[wolfy1339]

I can't do anything myself about that. I don't have access to those.

I am only a community contributor.

Personally, I get your point. The team hasn't been very active recently, and I've basically been the only one taking care of these packages.

[ShiyuBanzhou]

Dear Team @wolfy1339 ,
I understand the pressure of your work, as there are indeed many issues that need to be addressed in every project. Please trust that my intention in bringing up these issues is not to rush you, but rather to ensure that potential security vulnerabilities are addressed as soon as possible, with no ill intentions.
If possible, I would appreciate it if these security issues could be prioritized. I have already provided security advisories and fixes for each vulnerability found in the repositories, especially since many of these issues involve exploiting HTTP headers, which I believe pose a significant threat.
I heard that your team was on a business trip last week and should be returning soon. If possible, I would hope that these vulnerabilities could be given higher priority. I completely understand your schedule, and please feel free to reach out to me anytime should you need assistance.
Thank you for your hard work, and I look forward to your response.

[wolfy1339]

I completely get it, I too would like to get these fixed.

However, I can't do anything myself, I am not an employee of GitHub, and don't have access to the security vulnerabilities.

I do believe that once the responsible team is back, they will be prioritized properly.

[ShiyuBanzhou]

OK, I understand what you said. I will wait for the corresponding team to handle it. If you have any news, please let me know in time. Thank you very much for your reply. Thank you

[wolfy1339]

🎉 This PR is included in version 11.4.1 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀