Skip to content

Commit

Permalink
fix: update regular expression to remove ReDOS
Browse files Browse the repository at this point in the history
Fixes: #2
  • Loading branch information
Trott committed Sep 4, 2021
1 parent 0cd87f5 commit 6d89476
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 1 deletion.
2 changes: 1 addition & 1 deletion index.js
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
'use strict';

var regex = /^(?:\r\n|\n|\r)+|(?:\r\n|\n|\r)+$/g;
var regex = /^(?:\r|\n)+|(?:\r|\n)+$/g;

module.exports = function (str) {
return str.replace(regex, '');
Expand Down
7 changes: 7 additions & 0 deletions test.js
Original file line number Diff line number Diff line change
Expand Up @@ -19,3 +19,10 @@ it('should trim off \\r\\n', function () {
assert.strictEqual(trimOffNewlines('\r\nunicorns\r\n'), 'unicorns');
assert.strictEqual(trimOffNewlines('unicorns\r\n\r\n\r\n\r\n\r\n\r\n'), 'unicorns');
});

it('should not be susceptible to exponential backtracking', function () {
var start = Date.now();
trimOffNewlines('a' + '\r\n'.repeat(1000) + 'a');
var end = Date.now();
assert.ok(end - start < 1000, 'took too long, probably susceptible to ReDOS');
});

0 comments on commit 6d89476

Please sign in to comment.