Fix code scanning alert no. 14: Inefficient regular expression #40
Conversation
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @IsNotEmpty() | ||
| @ApiProperty({ type: String, default: '/' }) | ||
| @Matches(/^\/(\.?[^\/\0]+\/?)+$/, { message: 'Path must be a valid path' }) | ||
| @Matches(/^\/(?:\.?[^\/\0]+\/?)+$/, { message: 'Path must be a valid path' }) |
Check failure
Code scanning / CodeQL
Inefficient regular expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the problem, we need to modify the regular expression to remove the ambiguity that causes exponential backtracking. We can achieve this by making the sub-expression more specific and avoiding nested quantifiers. Specifically, we can replace \.?[^\/\0]+\/? with a more precise pattern that matches valid path segments without ambiguity.
The best way to fix the problem is to use a non-capturing group that matches either a single dot or a sequence of characters that are not slashes or null characters. This will eliminate the nested quantifiers and prevent exponential backtracking.
| @@ -35,3 +35,3 @@ | ||
| @ApiProperty({ type: String, default: '/' }) | ||
| @Matches(/^\/(?:\.?[^\/\0]+\/?)+$/, { message: 'Path must be a valid path' }) | ||
| @Matches(/^\/(?:\.[^\/\0]*|[^\/\0]+\/?)+$/, { message: 'Path must be a valid path' }) | ||
| public path: string; |
Fixes https://github.com/Libertech-FR/sesame-orchestrator/security/code-scanning/14
To fix the problem, we need to modify the regular expression to remove the ambiguity that causes exponential backtracking. Specifically, we can change the part of the regular expression that matches any character except
/and\0to be more specific and avoid nested repetitions.^\/(\.?[^\/\0]+\/?)+$[^\/\0]+inside(\.?[^\/\0]+\/?)+We can replace
[^\/\0]+with a more specific pattern that avoids ambiguity. One way to do this is to use a non-capturing group and ensure that the pattern does not allow for multiple ways to match the same string.Suggested fixes powered by Copilot Autofix. Review carefully before merging.