Port ReDoS vulnerability fix to Protobuf.js 5 (#1030)

protobufjs · Apr 30, 2018 · 243b098 · 243b098
1 parent 2028662
commit 243b098
Show file tree

Hide file tree

Showing 11 changed files with 192 additions and 204 deletions.
diff --git a/bower.json b/bower.json
@@ -1,7 +1,7 @@
 {
     "name": "protobuf",
     "description": "Protocol Buffers for JavaScript. Finally.",
-    "version": "5.0.2",
+    "version": "5.0.3",
     "main": "dist/protobuf.js",
     "license": "Apache-2.0",
     "homepage": "http://dcode.io/",

diff --git a/dist/protobuf-light.js b/dist/protobuf-light.js
@@ -57,7 +57,7 @@
      * @const
      * @expose
      */
-    ProtoBuf.VERSION = "5.0.2";
+    ProtoBuf.VERSION = "5.0.3";
 
     /**
      * Wire types.
@@ -429,10 +429,10 @@
         TYPEDEF: /^[a-zA-Z][a-zA-Z_0-9]*$/,
 
         // Type references
-        TYPEREF: /^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)+$/,
+        TYPEREF: /^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)(?:\.[a-zA-Z_][a-zA-Z_0-9]*)*$/,
 
         // Fully qualified type references
-        FQTYPEREF: /^(?:\.[a-zA-Z][a-zA-Z_0-9]*)+$/,
+        FQTYPEREF: /^(?:\.[a-zA-Z_][a-zA-Z_0-9]*)+$/,
 
         // All numbers
         NUMBER: /^-?(?:[1-9][0-9]*|0|0[xX][0-9a-fA-F]+|0[0-7]+|([0-9]*(\.[0-9]*)?([Ee][+-]?[0-9]+)?)|inf|nan)$/,

diff --git a/dist/protobuf-light.min.js b/dist/protobuf-light.min.js
diff --git a/dist/protobuf-light.min.js.gz b/dist/protobuf-light.min.js.gz
diff --git a/dist/protobuf-light.min.map b/dist/protobuf-light.min.map
diff --git a/dist/protobuf.js b/dist/protobuf.js
@@ -57,7 +57,7 @@
      * @const
      * @expose
      */
-    ProtoBuf.VERSION = "5.0.2";
+    ProtoBuf.VERSION = "5.0.3";
 
     /**
      * Wire types.
@@ -429,10 +429,10 @@
         TYPEDEF: /^[a-zA-Z][a-zA-Z_0-9]*$/,
 
         // Type references
-        TYPEREF: /^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)+$/,
+        TYPEREF: /^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)(?:\.[a-zA-Z_][a-zA-Z_0-9]*)*$/,
 
         // Fully qualified type references
-        FQTYPEREF: /^(?:\.[a-zA-Z][a-zA-Z_0-9]*)+$/,
+        FQTYPEREF: /^(?:\.[a-zA-Z_][a-zA-Z_0-9]*)+$/,
 
         // All numbers
         NUMBER: /^-?(?:[1-9][0-9]*|0|0[xX][0-9a-fA-F]+|0[0-7]+|([0-9]*(\.[0-9]*)?([Ee][+-]?[0-9]+)?)|inf|nan)$/,

diff --git a/dist/protobuf.min.js b/dist/protobuf.min.js
diff --git a/dist/protobuf.min.js.gz b/dist/protobuf.min.js.gz
diff --git a/dist/protobuf.min.map b/dist/protobuf.min.map
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "protobufjs",
-  "version": "5.0.2",
+  "version": "5.0.3",
   "description": "Protocol Buffers for JavaScript. Finally.",
   "author": "Daniel Wirtz <dcode@dcode.io>",
   "contributors": [

diff --git a/src/ProtoBuf/Lang.js b/src/ProtoBuf/Lang.js
@@ -21,10 +21,10 @@ ProtoBuf.Lang = {
     TYPEDEF: /^[a-zA-Z][a-zA-Z_0-9]*$/,
 
     // Type references
-    TYPEREF: /^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)+$/,
+    TYPEREF: /^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)(?:\.[a-zA-Z_][a-zA-Z_0-9]*)*$/,
 
     // Fully qualified type references
-    FQTYPEREF: /^(?:\.[a-zA-Z][a-zA-Z_0-9]*)+$/,
+    FQTYPEREF: /^(?:\.[a-zA-Z_][a-zA-Z_0-9]*)+$/,
 
     // All numbers
     NUMBER: /^-?(?:[1-9][0-9]*|0|0[xX][0-9a-fA-F]+|0[0-7]+|([0-9]*(\.[0-9]*)?([Ee][+-]?[0-9]+)?)|inf|nan)$/,