fix(security): mitigate potential ReDoS in link header regex (2.x)#712
fix(security): mitigate potential ReDoS in link header regex (2.x)#712RinZ27 wants to merge 1 commit intooctokit:2.xfrom
Conversation
|
👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with |
|
Ping on this performance tweak for the 2.x branch. It tightens the link header regex to avoid potential backtracking issues. Since it's a straightforward fix for stability, mind having a quick look? Thanks! |
RinZ27
changed the title
|
I decided to update the title to clarify that this is a security backport. By tightening the link header regex, I'm aiming to prevent potential ReDoS issues that I noticed in the current 2.x pattern. Since this is a minimal change that aligns the legacy branch with modern security practices, I'd appreciate it if someone could take a quick look when possible. |
1 participant
Link header parsing regex is currently a bit too loose, making it prone to backtracking issues. Replacing [^>]+ with [^<>]+ to keep it focused. Just backporting this to 2.x since it's a quick win for performance/stability.