fix(security): mitigate potential ReDoS in deprecation link regex (6.x)#796
fix(security): mitigate potential ReDoS in deprecation link regex (6.x)#796RinZ27 wants to merge 1 commit intooctokit:6.xfrom
Conversation
|
👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with |
|
Ping on this. It brings the more restrictive deprecation link regex from current versions back to the 6.x branch to mitigate potential ReDoS/backtracking issues. Mind taking a look? Thanks! |
|
I decided to update the title to better reflect that this is a security-related backport. This change brings the more restrictive regex logic from current versions into the 6.x branch, specifically to mitigate potential ReDoS issues that I noticed in the older pattern. Since this aligns 6.x with the security improvements already present in newer releases, I'd appreciate it if someone could take a quick look. |
The deprecation link regex in 6.x is still using a loose pattern that allows for excessive backtracking. Swapping it for the more restrictive logic used in current versions to prevent potential perf hits under load.