[#212] Fix Vulnerable Regular Expressions

[commenthol]

Fixes Issue #212 Vulnerable Regular Expressions

[will-swu]

@jprichardson nudge to look at merging this.

[shuurai]

The regular expressiong fix has resolved the denial of service vul.

[dwcaraway]

Also looking for this, thanks for the fix!

[az7arul]

Thanks @commenthol I will try to add this to the next release

[ceastman-ibm]

@az7arul any update on when the next release is?

[onexdata]

Is this getting merged or did the maintainers all get kidnapped?

[Frozenfire92]

bump

[xueyongg]

Has this fix been merged in?

[feload]

When will this change be merged?

[jxmot]

I'd be happy with a new release even if just this was in it.

[chrisatcloudwalk]

Wtf? Is this gonna be merged any time soon? Is anything left to do?

[Marioalf2002]

[#212] Arreglar Expresiones Regulares Vulnerables

[rhyanns]

Since the merge was not performed, does anyone have safer alternatives?

[SameOldNick]

As this PR is 8+ years old, this likely isn't getting merged. The following disables the vulnerable methods by injecting into the string prototype so safer alternatives are forced to be used:

Code

/**
 * Attaches warnings to insecure methods of the string library.
 * This is a security measure to prevent the use of insecure methods that could lead to vulnerabilities.
 */
const attachStringWarnings = (): void => {
    const str = S('');

    const proto = Object.getPrototypeOf(str);

    ['underscore', 'unescapeHTML'].forEach((method) => {
        proto[method] = function () {
            console.error(
                `Do not use ${method}() method from string as it is insecure. It has been overridden to log an error instead of executing. (CVE-2017-16116)`,
            );
        };
    });
};

// Add to JS entrypoint
attachStringWarnings();

Example

import S from 'string';

// Console output: Do not use unescapeHTML() method from string as it is insecure. It has been overridden to log an error instead of executing. (CVE-2017-16116)
const unescaped = S('wafwaf').unescapeHTML(); 

// Console output: Unescaped string: undefined
console.log('Unescaped string:', unescaped);