github-url-to-object - npm Package Compare versions

Comparing version 4.0.2 to 4.0.4

dist/commonjs.js

@@ -19,4 +19,4 @@ 'use strict'
 
-  var shorthand = repoUrl.match(/^([\w-_]+)\/([\w-_\.]+)#?([\w-_\.]+)?$/)
-  var mediumhand = repoUrl.match(/^github:([\w-_]+)\/([\w-_\.]+)#?([\w-_\.]+)?$/)
+  var shorthand = repoUrl.match(/^([\w-_]+)\/([\w-_\.]+)(?:#([\w-_\.]+))?$/)
+  var mediumhand = repoUrl.match(/^github:([\w-_]+)\/([\w-_\.]+)(?:#([\w-_\.]+))?$/)
   var antiquated = repoUrl.match(/^git@[\w-_\.]+:([\w-_]+)\/([\w-_\.]+)$/)
@@ -23,0 +23,0 @@

dist/gh.js

@@ -1,2 +0,2 @@
-(function(f){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=f()}else if(typeof define==="function"&&define.amd){define([],f)}else{var g;if(typeof window!=="undefined"){g=window}else if(typeof global!=="undefined"){g=global}else if(typeof self!=="undefined"){g=self}else{g=this}g.gh = f()}})(function(){var define,module,exports;return (function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a){ return a(o,!0); }if(i){ return i(o,!0); }var f=new Error("Cannot find module '"+o+"'");throw f.code="MODULE_NOT_FOUND",f}var l=n[o]={exports:{}};t[o][0].call(l.exports,function(e){var n=t[o][1][e];return s(n?n:e)},l,l.exports,e,t,n,r)}return n[o].exports}var i=typeof require=="function"&&require;for(var o=0;o<r.length;o++){ s(r[o]); }return s})({1:[function(require,module,exports){
+(function(f){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=f()}else if(typeof define==="function"&&define.amd){define([],f)}else{var g;if(typeof window!=="undefined"){g=window}else if(typeof global!=="undefined"){g=global}else if(typeof self!=="undefined"){g=self}else{g=this}g.gh = f()}})(function(){var define,module,exports;return (function(){function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a){ return a(o,!0); }if(i){ return i(o,!0); }var f=new Error("Cannot find module '"+o+"'");throw f.code="MODULE_NOT_FOUND",f}var l=n[o]={exports:{}};t[o][0].call(l.exports,function(e){var n=t[o][1][e];return s(n?n:e)},l,l.exports,e,t,n,r)}return n[o].exports}var i=typeof require=="function"&&require;for(var o=0;o<r.length;o++){ s(r[o]); }return s}return e})()({1:[function(require,module,exports){
 'use strict'
@@ -20,4 +20,4 @@
 
-  var shorthand = repoUrl.match(/^([\w-_]+)\/([\w-_\.]+)#?([\w-_\.]+)?$/)
-  var mediumhand = repoUrl.match(/^github:([\w-_]+)\/([\w-_\.]+)#?([\w-_\.]+)?$/)
+  var shorthand = repoUrl.match(/^([\w-_]+)\/([\w-_\.]+)(?:#([\w-_\.]+))?$/)
+  var mediumhand = repoUrl.match(/^github:([\w-_]+)\/([\w-_\.]+)(?:#([\w-_\.]+))?$/)
   var antiquated = repoUrl.match(/^git@[\w-_\.]+:([\w-_]+)\/([\w-_\.]+)$/)
@@ -24,0 +24,0 @@

index.js

@@ -19,4 +19,4 @@ 'use strict'
 
-  var shorthand = repoUrl.match(/^([\w-_]+)\/([\w-_\.]+)#?([\w-_\.]+)?$/)
-  var mediumhand = repoUrl.match(/^github:([\w-_]+)\/([\w-_\.]+)#?([\w-_\.]+)?$/)
+  var shorthand = repoUrl.match(/^([\w-_]+)\/([\w-_\.]+)(?:#([\w-_\.]+))?$/)
+  var mediumhand = repoUrl.match(/^github:([\w-_]+)\/([\w-_\.]+)(?:#([\w-_\.]+))?$/)
   var antiquated = repoUrl.match(/^git@[\w-_\.]+:([\w-_]+)\/([\w-_\.]+)$/)
@@ -23,0 +23,0 @@

package.json

 {
   "name": "github-url-to-object",
-  "version": "4.0.2",
+  "version": "4.0.4",
   "description": "Extract user, repo, and other interesting properties from GitHub URLs",
@@ -5,0 +5,0 @@ "main": "dist/commonjs.js",

test/index.js

@@ -27,2 +27,24 @@ /* globals before, describe, it */
     })
+
+    it('is not vulnerable to REDOS', function () {
+      var prefix = 'a/a'
+      var pump = 'a'
+      var suffix = 'a/'
+
+      var attackString = prefix
+      for (var i = 0; i < 25000; i++) {
+        attackString += pump
+      }
+      attackString += suffix
+
+      console.log('matching')
+      var before = process.hrtime()
+      var obj = gh(attackString)
+      var elapsed = process.hrtime(before)
+
+      // Invalid input so should be rejected...
+      assert.equal(obj, null)
+      // ...but how quickly?
+      assert.equal(elapsed[0], 0)
+    })
   })
@@ -55,2 +77,23 @@
     })
+
+    it('is not vulnerable to REDOS', function () {
+      var prefix = 'github:a/a'
+      var pump = 'a'
+      var suffix = 'ub.:'
+
+      var attackString = prefix
+      for (var i = 0; i < 25000; i++) {
+        attackString += pump
+      }
+      attackString += suffix
+
+      var before = process.hrtime()
+      var obj = gh(attackString)
+      var elapsed = process.hrtime(before)
+
+      // Invalid input so should be rejected...
+      assert.equal(obj, null)
+      // ...but how quickly?
+      assert.equal(elapsed[0], 0)
+    })
   })
@@ -57,0 +100,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

29030

increased by3.98%

Lines of code

565

increased by6.6%

Worsened metrics

Number of package files

10

decreased by-9.09%

No dependency changes