You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
log.Debug(fmt.Sprintf("impacted dependency '%s' not found in descriptor '%s', moving to the next descriptor if exists...", impactedDependency, conanFilePath))
err=fmt.Errorf("an error occured while writing the fixed version of %s to the requirements file '%s': %s", vulnDetails.ImpactedDependencyName, conanFilePath, err.Error())
A ReDoS in minimatch may result in a denial-of-service when processing a crafted glob pattern.
56
+
57
+
### 🔬 JFrog Research Details
58
+
59
+
**Description:**
60
+
[Minimatch](https://github.com/isaacs/minimatch) is a JavaScript library used to convert glob expressions into JavaScript objects for minimal matching.
61
+
62
+
63
+
**Remediation:**
64
+
##### Development mitigations
65
+
66
+
The user can use a simple function to count the occurrences of "*" in the input string to make sure it is safe to use before calling `minimatch`:
67
+
68
+
```
69
+
function redosDetector(input_string, limit) {
70
+
71
+
if (typeof input_string !== 'string') {
72
+
throw new Error('Input must be a string');
73
+
}
74
+
75
+
let count = 0;
76
+
for (const char of input_string) {
77
+
if (char === '**') count++;
78
+
}
79
+
80
+
if (count > limit) {
81
+
throw new Error('Input string contains too many * characters, ReDoS detected');
82
+
}
83
+
84
+
return count;
85
+
}
86
+
```
87
+
88
+
Another option is to use the safe `{ noext: true }` option if your application doesn't require extglob processing
A ReDoS in minimatch may result in a denial-of-service when processing a crafted glob pattern.
104
+
105
+
### 🔬 JFrog Research Details
106
+
107
+
**Description:**
108
+
[Minimatch](https://github.com/isaacs/minimatch) is a JavaScript library used to convert glob expressions into JavaScript objects for minimal matching.
109
+
110
+
111
+
**Remediation:**
112
+
##### Development mitigations
113
+
114
+
The user can use a simple function to count the occurrences of "**" in the input string to make sure it is safe to use before calling `minimatch`:
115
+
116
+
```
117
+
function redosDetector(input_string, limit) {
118
+
119
+
if (typeof input_string !== 'string') {
120
+
throw new Error('Input must be a string');
121
+
}
122
+
123
+
let count = 0;
124
+
for (const char of input_string) {
125
+
if (char === '**') count++;
126
+
}
127
+
128
+
if (count > limit) {
129
+
throw new Error('Input string contains too many * characters, ReDoS detected');
0 commit comments