File tree 2 files changed +35
-1
lines changed
2 files changed +35
-1
lines changed Original file line number Diff line number Diff line change @@ -49,7 +49,7 @@ export class RequestError extends Error {
49
49
if ( options . request . headers . authorization ) {
50
50
requestCopy . headers = Object . assign ( { } , options . request . headers , {
51
51
authorization : options . request . headers . authorization . replace (
52
- / .* $ / ,
52
+ / (?< ! ) .* $ / ,
53
53
" [REDACTED]" ,
54
54
) ,
55
55
} ) ;
Original file line number Diff line number Diff line change @@ -17,6 +17,40 @@ const mockOptions: RequestErrorOptions = {
17
17
} ;
18
18
19
19
describe ( "RequestError" , ( ) => {
20
+ test ( "Test ReDoS - attack string" , ( ) => {
21
+ const startTime = performance . now ( ) ;
22
+ const error = new RequestError ( "Oops" , 500 , {
23
+ request : {
24
+ method : "POST" ,
25
+ url : "https://api.github.com/foo" ,
26
+ body : {
27
+ bar : "baz" ,
28
+ } ,
29
+ headers : {
30
+ authorization : "" + " " . repeat ( 100000 ) + "\n@" ,
31
+ } ,
32
+ } ,
33
+ response : {
34
+ status : 500 ,
35
+ url : "https://api.github.com/foo" ,
36
+ headers : {
37
+ "x-github-request-id" : "1:2:3:4" ,
38
+ } ,
39
+ data : {
40
+ foo : "bar" ,
41
+ } ,
42
+ } ,
43
+ } ) ;
44
+ const endTime = performance . now ( ) ;
45
+ const elapsedTime = endTime - startTime ;
46
+ const reDosThreshold = 2000 ;
47
+
48
+ expect ( elapsedTime ) . toBeLessThanOrEqual ( reDosThreshold ) ;
49
+ if ( elapsedTime > reDosThreshold ) {
50
+ console . warn ( `🚨 Potential ReDoS Attack! getDuration method took ${ elapsedTime . toFixed ( 2 ) } ms, exceeding threshold of ${ reDosThreshold } ms.` ) ;
51
+ }
52
+ } ) ;
53
+
20
54
test ( "inherits from Error" , ( ) => {
21
55
const error = new RequestError ( "test" , 123 , mockOptions ) ;
22
56
expect ( error ) . toBeInstanceOf ( Error ) ;
You can’t perform that action at this time.
0 commit comments