secretlint / secretlint

Pluggable linting tool to prevent committing credential.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Fix ReDos

azu opened this issue · comments

commented

CodeQL detect ReDoS on packages/@secretlint/secretlint-rule-npm/src/index.ts:45

This that depends on may run slow on strings starting with 'http://' and with many repetitions of 'http://a/'.

const results = source.content.matchAll(XOAuthPattern);

Tracking issue for:

Probably, we can use const XOAuthPattern = /https?:\/\/(.{1,256}):x-oauth-basic@github.com\//g;

commented

fixed