Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit b51ed27

Browse filesBrowse files
committed
test: ReDos regex vulnerability, reported by @dayshift
1 parent 12a14f0 commit b51ed27
Copy full SHA for b51ed27

File tree

Expand file treeCollapse file tree

1 file changed

+36
-0
lines changed
Filter options
Expand file treeCollapse file tree

1 file changed

+36
-0
lines changed

‎test/request-error.test.ts

Copy file name to clipboardExpand all lines: test/request-error.test.ts
+36Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,42 @@ const mockOptions: RequestErrorOptions = {
1010
};
1111

1212
describe("RequestError", () => {
13+
test("Test ReDoS - attack string", () => {
14+
const startTime = performance.now();
15+
const error = new RequestError("Oops", 500, {
16+
request: {
17+
method: "POST",
18+
url: "https://api.github.com/foo",
19+
body: {
20+
bar: "baz",
21+
},
22+
headers: {
23+
authorization: "" + " ".repeat(100000) + "\n@",
24+
},
25+
},
26+
response: {
27+
status: 500,
28+
url: "https://api.github.com/foo",
29+
headers: {
30+
"x-github-request-id": "1:2:3:4",
31+
},
32+
data: {
33+
foo: "bar",
34+
},
35+
},
36+
});
37+
const endTime = performance.now();
38+
const elapsedTime = endTime - startTime;
39+
const reDosThreshold = 2000;
40+
expect(elapsedTime).toBeLessThanOrEqual(reDosThreshold);
41+
if (elapsedTime > reDosThreshold) {
42+
console.warn(
43+
`🚨 Potential ReDoS Attack! getDuration method took ${elapsedTime.toFixed(
44+
2,
45+
)} ms, exceeding threshold of ${reDosThreshold} ms.`,
46+
);
47+
}
48+
});
1349
test("inherits from Error", () => {
1450
const error = new RequestError("test", 123, mockOptions);
1551
expect(error).toBeInstanceOf(Error);

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.