fix(isSlug & rtrim): regex no longer exposed to ReDOS attacks (#1603)

validatorjs · Mar 3, 2021 · 6d87bfe · 6d87bfe
1 parent 2331120
commit 6d87bfe
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/lib/isSlug.js b/src/lib/isSlug.js
@@ -1,6 +1,6 @@
 import assertString from './util/assertString';
 
-let charsetRegex = /^[^\s-_](?!.*?[-_]{2,})([a-z0-9-\\]{1,})[^\s]*[^-_\s]$/;
+let charsetRegex = /^[^\s-_](?!.*?[-_]{2,})[a-z0-9-\\][^\s]*[^-_\s]$/;
 
 export default function isSlug(str) {
   assertString(str);

diff --git a/src/lib/rtrim.js b/src/lib/rtrim.js
@@ -3,6 +3,6 @@ import assertString from './util/assertString';
 export default function rtrim(str, chars) {
   assertString(str);
   // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
-  const pattern = chars ? new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g') : /\s+$/g;
+  const pattern = chars ? new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g') : /(\s)+$/g;
   return str.replace(pattern, '');
 }