Skip to content

fix(security): mitigate potential ReDoS in deprecation link regex (6.x)#796

Open
RinZ27 wants to merge 1 commit intooctokit:6.xfrom
RinZ27:6.x-security
Open

fix(security): mitigate potential ReDoS in deprecation link regex (6.x)#796
RinZ27 wants to merge 1 commit intooctokit:6.xfrom
RinZ27:6.x-security

Conversation

@RinZ27
Copy link

@RinZ27 RinZ27 commented Jan 3, 2026

The deprecation link regex in 6.x is still using a loose pattern that allows for excessive backtracking. Swapping it for the more restrictive logic used in current versions to prevent potential perf hits under load.

@octokit
Copy link

octokit bot commented Jan 3, 2026

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

@RinZ27
Copy link
Author

RinZ27 commented Jan 12, 2026

Ping on this. It brings the more restrictive deprecation link regex from current versions back to the 6.x branch to mitigate potential ReDoS/backtracking issues. Mind taking a look? Thanks!

@RinZ27 RinZ27 changed the title perf: improve deprecation link parsing in 6.x fix(security): mitigate potential ReDoS in deprecation link regex (6.x) Jan 20, 2026
@RinZ27
Copy link
Author

RinZ27 commented Jan 20, 2026

I decided to update the title to better reflect that this is a security-related backport. This change brings the more restrictive regex logic from current versions into the 6.x branch, specifically to mitigate potential ReDoS issues that I noticed in the older pattern. Since this aligns 6.x with the security improvements already present in newer releases, I'd appreciate it if someone could take a quick look.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: 🆕 Triage

Development

Successfully merging this pull request may close these issues.

1 participant