Skip to content

Commit ca09ae8

Browse files
FBNealkelset
authored andcommitted
Update validateBaseUrl to use latest regex
Summary: Updating the regex to avoid a potential regular expression denial-of-service vulnerability. Changelog: Update validateBaseUrl to use a more robust regular expression. Fixes CVE-2020-1920, GHSL-2020-293 Reviewed By: lunaleaps Differential Revision: D25507604 fbshipit-source-id: c36a03c456881bc655c861e1a2c5cd41a7127c9d
1 parent 166a5dd commit ca09ae8

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

Libraries/Blob/URL.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ export class URLSearchParams {
107107

108108
function validateBaseUrl(url: string) {
109109
// from this MIT-licensed gist: https://gist.github.com/dperini/729294
110-
return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,}))?)(?::\d{2,5})?(?:[/?#]\S*)?$/i.test(
110+
return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)*(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/.test(
111111
url,
112112
);
113113
}

0 commit comments

Comments
 (0)