GeezerVison is showing github.com — fix: disable regexp backtracking (#160) · moxystudio/node-cross-spawn@ba5aaef
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: lib/util/escape.js +4-2Lines changed: 4 additions & 2 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -15,15 +15,17 @@ function escapeArgument(arg, doubleEscapeMetaChars) { |
15 | 15 | arg = `${arg}`; |
16 | 16 |
|
17 | 17 | // Algorithm below is based on https://qntm.org/cmd |
| 18 | + // It's slightly altered to disable JS backtracking to avoid hanging on specially crafted input |
| 19 | + // Please see https://github.com/moxystudio/node-cross-spawn/pull/160 for more information |
18 | 20 |
|
19 | 21 | // Sequence of backslashes followed by a double quote: |
20 | 22 | // double up all the backslashes and escape the double quote |
21 | | - arg = arg.replace(/(\\*)"/g, '$1$1\\"'); |
| 23 | + arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"'); |
22 | 24 |
|
23 | 25 | // Sequence of backslashes followed by the end of the string |
24 | 26 | // (which will become a double quote later): |
25 | 27 | // double up all the backslashes |
26 | | - arg = arg.replace(/(\\*)$/, '$1$1'); |
| 28 | + arg = arg.replace(/(?=(\\+?)?)\1$/, '$1$1'); |
27 | 29 |
|
28 | 30 | // All other backslashes occur literally |
29 | 31 |
|
|