Home Original page

fix(isMagnetURI): update validation regex by tux-tn · Pull Request #1730 · validatorjs/validator.js

Conversation

@tux-tn

This PR updates the isMagnetURI validator regex:

  • Fix ReDOS in old regex (thanks to @yetingli for discovering the vulnerability and @JamieSlome for reporting it)
  • Validate only exact xt topics (btih,sha1,...) based on this list
  • Validate only 32 or 40 hashes (Old regex was validating length between 32 and 40 even if only 32 (md5 and sha1) and 40 (btih, ed2k,...) character hashes are valid )
  • Make tr and dn parameters optional (Magnet URI definition doesn't specify if other parameters than xt are required
  • Allow passing multiple xt urn using the standard xt.1 and xt.2,... (URI is valid even if only xt.1 is passed)
  • Allow any other parameter (protocol allow passing non standard parameters)
  • Use placeholder hashes in tests
  • Add new tests

All the changes are based on the Magnet URI scheme definition here , there is no IETF RFC concerning magnet URI.

Checklist

  • PR contains only changes related; no stray files, etc.
  • Tests written (where applicable)
- Validate only exact xn topics (btih,sha1,...)
- Validate only 32 or 40 hashes
- Make tr and dn parameters optional
- Allow any other parameter (protocol allow passing non standard parameters)
- Use placeholder hashes in tests 
- Fix ReDOS in old regex
- Add new tests

@codecov

ezkemboi

profnandaa

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for the fix.

profnandaa

profnandaa

@profnandaa

@tux-tn @ezkemboi -- let me do a release this weekend. You can help complete reviews of the remaining PRs.

@ezkemboi

@tux-tn tux-tn deleted the hotfix/isMagnet branch

September 21, 2021 09:30

@tux-tn

Labels