pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-03 13:52:09 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): linear-time Basic-auth regex in the dev webdav handler (CodeQL js/polynomial-redos #708)

Browse Source
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-07-13 05:00:49 -03:00
parent 1c3cca399b
commit 3cf0b1cd58
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
scripts/dev/webdav-handler.mjs
View File

@@ -205,7 +205,7 @@ export function resolveDestinationPath(vaultRoot, destinationHeader) {
export function verifyBasicAuth(authHeader, expectedUsername, expectedPassword) {
if (!authHeader || typeof authHeader !== "string") return false;
const match = /^Basic\s+(.+)$/i.exec(authHeader.trim());
const match = /^Basic[ \t]+(\S+)$/i.exec(authHeader.trim()); // linear-time: no overlapping \s+/.+ backtracking (CodeQL js/polynomial-redos #708)
if (!match) return false;
let decoded;