Unverified Commit 4196fcf2 authored by Myles Borins's avatar Myles Borins
Browse files

path: unwind regular expressions in POSIX

This is the first part to removing REDOS vulnerabilities from v4.x

The function `splitPathRe` exposed a REDOS vulnerability. It was only
utilized in the POSIX implementation of a number of the path utilities.
In v6.x a change landed that unwound this regular expression, and in
turn patched the vulnerability.

This commit copies the unwound implementation currently found on v8.x.
It is completely self contained. I attempted to keep all warnings
and deprecations the same as the v4.x implementation, but may have
missed something buried in the large unwound functions.

Refs: https://github.com/nodejs/node/commit/b212be08f6
parent b39ba55a
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment