fix(security): replace regex with loop to prevent ReDoS
CodeQL flagged `/\/+$/` as polynomial-time on repeated slashes.
Use `while (endsWith("/"))` loop instead.
This commit is contained in:
2 files changed
+4
-2
No files matched your search
@@ -12,7 +12,8 @@ export const buildIntegrationUrl = (
|
||||
mode: UrlTemplateMode,
|
||||
dockerPort?: number,
|
||||
): string => {
|
||||
const host = baseHost.trim().replace(/\/+$/, "");
|
||||
let host = baseHost.trim();
|
||||
while (host.endsWith("/")) host = host.slice(0, -1);
|
||||
if (!host) return "";
|
||||
|
||||
const slug = getSlugForKind(kind);
|
||||
|
||||
@@ -474,7 +474,8 @@ export const getIntegrationDefaultPort = (kind: IntegrationKind): number | undef
|
||||
export const getIntegrationApiKeyUrl = (integrationUrl: string, kind: IntegrationKind): string | null => {
|
||||
const definition = integrationDefs[kind];
|
||||
if (!("apiKeySettingsPath" in definition)) return null;
|
||||
const base = integrationUrl.replace(/\/+$/, "");
|
||||
let base = integrationUrl;
|
||||
while (base.endsWith("/")) base = base.slice(0, -1);
|
||||
if (!base) return null;
|
||||
return `${base}${definition.apiKeySettingsPath}`;
|
||||
};
|
||||
|
||||
Reference in new issue
Block a user