safe-regex - npm Package Compare versions

Comparing version 1.1.0 to 2.0.0

index.js

@@ -1,39 +0,46 @@
-var parse = require('ret');
-var types = parse.types;
+const regexpTree = require('regexp-tree');
 
 module.exports = function (re, opts) {
-    if (!opts) opts = {};
-    var replimit = opts.limit === undefined ? 25 : opts.limit;
-    
-    if (isRegExp(re)) re = re.source;
-    else if (typeof re !== 'string') re = String(re);
-    
-    try { re = parse(re) }
-    catch (err) { return false }
-    
-    var reps = 0;
-    return (function walk (node, starHeight) {
-        if (node.type === types.REPETITION) {
-            starHeight ++;
-            reps ++;
-            if (starHeight > 1) return false;
-            if (reps > replimit) return false;
+  if (!opts) opts = {};
+  const replimit = opts.limit === undefined ? 25 : opts.limit;
+
+  let pattern = null;
+  if (isRegExp(re)) pattern = re.source;
+  else if (typeof re === 'string') pattern = re;
+  else pattern = String(re);
+
+  let ast = null;
+  try {
+    ast = regexpTree.parse(pattern);
+  } catch (err) {
+    try {
+      ast = regexpTree.parse(`/${pattern}/`); }
+    catch (err) {
+      return false;
+    }
+  }
+
+  let currentStarHeight = 0;
+  let maxObservedStarHeight = 0;
+
+  let repetitionCount = 0;
+
+  regexpTree.traverse(ast, {
+    'Repetition': {
+      pre ({node}) {
+        repetitionCount++;
+
+        currentStarHeight++;
+        if (maxObservedStarHeight < currentStarHeight) {
+          maxObservedStarHeight = currentStarHeight;
         }
-        
-        if (node.options) {
-            for (var i = 0, len = node.options.length; i < len; i++) {
-                var ok = walk({ stack: node.options[i] }, starHeight);
-                if (!ok) return false;
-            }
-        }
-        var stack = node.stack || (node.value && node.value.stack);
-        if (!stack) return true;
-        
-        for (var i = 0; i < stack.length; i++) {
-            var ok = walk(stack[i], starHeight);
-            if (!ok) return false;
-        }
-        
-        return true;
-    })(re, 0);
+      },
+
+      post ({node}) {
+        currentStarHeight--;
+      }
+    }
+  });
+
+  return (maxObservedStarHeight <= 1) && (repetitionCount <= replimit);
 };
@@ -40,0 +47,0 @@

package.json

 {
   "name": "safe-regex",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "description": "detect possibly catastrophic, exponential-time regular expressions",
   "main": "index.js",
   "dependencies": {
-    "ret": "~0.1.10"
+    "regexp-tree": "~0.0.85"
   },
@@ -27,5 +27,5 @@ "devDependencies": {
     "type": "git",
-    "url": "git://github.com/substack/safe-regex.git"
+    "url": "git://github.com/davisjam/safe-regex.git"
   },
-  "homepage": "https://github.com/substack/safe-regex",
+  "homepage": "https://github.com/davisjam/safe-regex",
   "keywords": [
@@ -39,7 +39,7 @@ "catastrophic",
   "author": {
-    "name": "James Halliday",
-    "email": "[e-mail]",
-    "url": "http://substack.net"
+    "name": "James C. (Jamie) Davis",
+    "email": "[e-mail]",
+    "url": "http://people.cs.vt.edu/~davisjam"
   },
   "license": "MIT"
 }

test/regex.js

@@ -10,3 +10,7 @@ var safe = require('../');
     /^\d+(1337|404)*\d+$/i,
+    /(a+)|(b+)/,
     RegExp(Array(26).join('a?') + Array(26).join('a')),
+    // String input.
+    'aaa',
+    '/^\d+(1337|404)*\d+$/'
 ];
@@ -29,3 +33,10 @@
     /(a+){2}y/,
-    /(.*){1,32000}[bc]/
+    /(.*){1,32000}[bc]/,
+    // Star height with branching and nesting.
+    /(a*|b)+$/,
+    /(a|b*)+$/,
+    /(((b*)))+$/,
+    /(((b*))+)$/,
+    // String input.
+    '(a+)+'
 ];
@@ -32,0 +43,0 @@

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

No website

Quality

Package does not have a website.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

6297

7.27%

Number of package files

8

14.29%

Lines of code

97

19.75%

Number of low quality alerts

0

-100%

Worsened metrics

Number of lines in readme file

64

-3.03%

Number of medium supply chain risk alerts

1

Infinity%

Dependency changes

• + Added

  regexp-tree@~0.0.85

• + Added

  ansi-regex@2.1.13.0.1
  (transitive)

• + Added

  camelcase@4.1.0
  (transitive)

• + Added

  cli-table3@0.5.1
  (transitive)

• + Added

  cliui@4.1.0
  (transitive)

• + Added

  code-point-at@1.1.0
  (transitive)

• + Added

  colors@1.4.0
  (transitive)

• + Added

  cross-spawn@5.1.0
  (transitive)

• + Added

  decamelize@1.2.0
  (transitive)

• + Added

  execa@0.7.0
  (transitive)

• + Added

  find-up@2.1.0
  (transitive)

• + Added

  get-caller-file@1.0.3
  (transitive)

• + Added

  get-stream@3.0.0
  (transitive)

• + Added

  invert-kv@1.0.0
  (transitive)

• + Added

  is-fullwidth-code-point@1.0.02.0.0
  (transitive)

• + Added

  is-stream@1.1.0
  (transitive)

• + Added

  isexe@2.0.0
  (transitive)

• + Added

  lcid@1.0.0
  (transitive)

• + Added

  locate-path@2.0.0
  (transitive)

• + Added

  lru-cache@4.1.5
  (transitive)

• + Added

  mem@1.1.0
  (transitive)

• + Added

  mimic-fn@1.2.0
  (transitive)

• + Added

  npm-run-path@2.0.2
  (transitive)

• + Added

  number-is-nan@1.0.1
  (transitive)

• + Added

  object-assign@4.1.1
  (transitive)

• + Added

  os-locale@2.1.0
  (transitive)

• + Added

  p-finally@1.0.0
  (transitive)

• + Added

  p-limit@1.3.0
  (transitive)

• + Added

  p-locate@2.0.0
  (transitive)

• + Added

  p-try@1.0.0
  (transitive)

• + Added

  path-exists@3.0.0
  (transitive)

• + Added

  path-key@2.0.1
  (transitive)

• + Added

  pseudomap@1.0.2
  (transitive)

• + Added

  regexp-tree@0.0.86
  (transitive)

• + Added

  require-directory@2.1.1
  (transitive)

• + Added

  require-main-filename@1.0.1
  (transitive)

• + Added

  set-blocking@2.0.0
  (transitive)

• + Added

  shebang-command@1.2.0
  (transitive)

• + Added

  shebang-regex@1.0.0
  (transitive)

• + Added

  signal-exit@3.0.7
  (transitive)

• + Added

  string-width@1.0.22.1.1
  (transitive)

• + Added

  strip-ansi@3.0.14.0.0
  (transitive)

• + Added

  strip-eof@1.0.0
  (transitive)

• + Added

  which@1.3.1
  (transitive)

• + Added

  which-module@2.0.1
  (transitive)

• + Added

  wrap-ansi@2.1.0
  (transitive)

• + Added

  y18n@3.2.2
  (transitive)

• + Added

  yallist@2.1.2
  (transitive)

• + Added

  yargs@10.1.2
  (transitive)

• + Added

  yargs-parser@8.1.0
  (transitive)

• - Removed

  ret@~0.1.10

• - Removed

  ret@0.1.15
  (transitive)