yarnpkg
Request manager re dos
Steps to reproduce Hello,
I am writing to report a potential Regular Expression Denial of Service (ReDoS) vulnerability or Inefficient Regular Expression in the project. When using specially crafted input strings in the context, it may lead to extremely high CPU usage, application freezing, or denial of service attacks.
Location of Issue:
The vulnerability is related to a regular expression used in the following validation file, which may result in significantly prolonged execution times under certain conditions.
https://github.com/yarnpkg/yarn/blob/7cafa512a777048ce0b666080a24e80aae3d66a9/src/util/request-manager.js#L187
1.git clone https://github.com/mmmsssttt404/yarn.git
2.yarn install
3.yarn test __tests__/util/request-manager.js
use time:
Proposed Solution:
Change the regular expression to
https://github.com/mmmsssttt404/yarn/blob/f54fa0f0e0cdec16583b572dec679c9fbf9073a4/src/util/request-manager.js#L187
Thank you for your attention to this matter. Your evaluation and response to this potential security concern would be greatly appreciated.
Best regards,
Search keywords: ReDoS
