Skip to content

Security fix for ReDoS #1517

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 3, 2021
Merged

Security fix for ReDoS #1517

merged 1 commit into from
Sep 3, 2021

Conversation

ready-research
Copy link
Contributor

@ready-research ready-research commented Sep 2, 2021

Description

Fixed Regular Expression Denial of Service vulnerability in url validation

Reported in https://www.huntr.dev/bounties/d75e0a82-995c-451b-8e9f-191648290c81/
Please validate in above link

Changelog

The regex used in Validators.js is vulnerable to ReDoS attacks

Fixed Regular Expression Denial of Service vulnerability in url validation
@ethanshar ethanshar merged commit 39876ae into wix:master Sep 3, 2021
@ready-research
Copy link
Contributor Author

@ethanshar Please validate this in https://www.huntr.dev/bounties/d75e0a82-995c-451b-8e9f-191648290c81/ access using your GitHub login on the top right corner of huntr page. If you are able to access it, then you can just click on mark as valid, and also you can confirm the fix.

@ethanshar
Copy link
Collaborator

Hi @ready-research
I marked the issue as valid.
Unfortunately, I can't "Confirm Fix" because I doesn't find your branch in the list.

@ready-research
Copy link
Contributor Author

@ethanshar You can use this merge commit and credit me for the fix.

@JamieSlome
Copy link

@ethanshar @ready-research - just jumping in to help 👋

@ready-research - to ensure that you are credited for the fix, make sure you have submitted the patch via the platform.

@ethanshar - you just need to select the commit SHA on the wix:master branch, and commits for this branch are then selectable.

Screenshot 2021-09-12 at 09 09 28

@ethanshar
Copy link
Collaborator

Hi,
See my comment here
Unfortunately, I can't find the relevant commit.
I'd love to assist, let me know what to do

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants