Skip to content
This repository was archived by the owner on Nov 4, 2024. It is now read-only.
This repository was archived by the owner on Nov 4, 2024. It is now read-only.

Unescaped identifiers regex causes DoS by heap exhaustion/infinite loop #694

@ghost

Description

It's prevalent to import Sanctuary as S and sanctuary-def as $, i.e:

import S from "sanctuary"
import $ from "sanctuary-def"

The problem is that esm's find-indexes is using the unescaped identifiers in a regex (e.g: S and $), which, in this case, causes an infinite loop, i.e:
pattern becomes new RegExp("\\b(?:S|$)\\b", "g") which matches 0 characters, and therefore matches infinitely (e.g in the while loop).

Suggested bug fix: escape the identifiers used in the regex.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions