path: unwind regular expressions in Windows
This is the second part to removing REDOS vulnerabilities from v4.x The function `splitTailRe` exposed a REDOS vulnerability. It was only utilized in the Windows implementation of a number of the path utilities. In v6.x a change landed that unwound this regular expression, and in turn patched the vulnerability. This commit copies the unwound implementation currently found on v8.x. It is completely self contained. I attempted to keep all warnings and deprecations the same as the v4.x implementation, but may have missed something buried in the large unwound functions. Refs: https://github.com/nodejs/node/commit/b212be08f6
parent
4196fcf2
Please register or sign in to comment