
Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
The safe-regex package is a utility for checking if a given regular expression is safe and not susceptible to ReDoS (Regular Expression Denial of Service) attacks. It evaluates the complexity of regular expressions and determines if they can potentially cause exponential time complexity issues.
Safety Check
This feature allows developers to check if a regular expression is safe to use, preventing potential ReDoS attacks. The function returns a boolean indicating whether the regex is considered safe.
const safeRegex = require('safe-regex');
const regex = /a+$/;
console.log(safeRegex(regex)); // Outputs: true or false depending on the safety
This package is similar to safe-regex as it also checks for potentially vulnerable regular expressions that could lead to ReDoS attacks. It provides a more comprehensive analysis and supports asynchronous API, making it suitable for larger applications compared to safe-regex.
Like safe-regex, regex-safe is designed to ensure that regular expressions are safe from ReDoS attacks. It offers a simple API to validate regex patterns but does not provide the detailed analysis or support for asynchronous operations found in some other packages.
Detect potentially catastrophic exponential-time regular expressions by limiting the star height to 1.
WARNING: This module has both false positives and false negatives. Use vuln-regex-detector for improved accuracy.
Suppose you have a script named safe.js
:
var safe = require('safe-regex');
var regex = process.argv.slice(2).join(' ');
console.log(safe(regex));
This is its behavior:
$ node safe.js '(x+x+)+y'
false
$ node safe.js '(beep|boop)*'
true
$ node safe.js '(a+){10}'
false
$ node safe.js '\blocation\s*:[^:\n]+\b(Oakland|San Francisco)\b'
true
const safe = require('safe-regex')
Return a boolean ok
whether or not the regex re
is safe and not possibly
catastrophic.
re
can be a RegExp
object or just a string.
If the re
is a string and is an invalid regex, returns false
.
opts.limit
- maximum number of allowed repetitions in the entire regex.
Default: 25
.With npm do:
npm install safe-regex
The following documents may be edifying:
This project follows Semantic Versioning 2.0 (semver).
Here are the project-specific meanings of MAJOR, MINOR, and PATCH updates:
FAQs
detect possibly catastrophic, exponential-time regular expressions
The npm package safe-regex receives a total of 0 weekly downloads. As such, safe-regex popularity was classified as not popular.
We found that safe-regex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.