Do not use variable for regular expressions

Docs > Code Analysis > Static Analysis Rules > Do not use variable for regular expressions

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: typescript-browser-security/regexp-non-literal

Language: TypeScript

Severity: Warning

Category: Security

Description

Regular expressions should not use a variable as an argument since an attacker may inject values and cause a regular expression denial of service (ReDoS). Instead, use a library like recheck to check that no DoS can be triggered by regular expression.

Non-Compliant Code Examples

const foo = new RegExp(req.something);
const bar = new RegExp(variable);

Compliant Code Examples

const foo = new RegExp(`^\\d+-${topicId}$`);
const foo = new RegExp(/something/);
const foo = new RegExp("weofiwje");