From e6f4c377342a8397def6a012f1eaf8f44855fa4f Mon Sep 17 00:00:00 2001 From: Carlos Date: Mon, 30 Oct 2023 18:52:27 -0300 Subject: [PATCH] adding a regular expression with ancors and solve the ReDos problem --- app/routes/profile.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/app/routes/profile.js b/app/routes/profile.js index 0b5b34f2d..d8d583fca 100644 --- a/app/routes/profile.js +++ b/app/routes/profile.js @@ -55,8 +55,10 @@ function ProfileHandler(db) { // with an exponential time until it completes // -- // The Fix: Instead of using greedy quantifiers the same regex will work if we omit the second quantifier + - // const regexPattern = /([0-9]+)\#/; - const regexPattern = /([0-9]+)+\#/; + // const regexPattern = /^[0-9]+\#$/; + const regexPattern = /^([0-9]+)+\#$/; + + // Allow only numbers with a suffix of the letter #, for example: 'XXXXXX#' const testComplyWithRequirements = regexPattern.test(bankRouting); // if the regex test fails we do not allow saving