Do not use variable for regular expressions

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.


ID: typescript-browser-security/regexp-non-literal

Language: TypeScript

Severity: Warning

Category: Security


Regular expressions should not use a variable as an argument since an attacker may inject values and cause a regular expression denial of service (ReDoS). Instead, use a library like recheck to check that no DoS can be triggered by regular expression.

Non-Compliant Code Examples

const foo = new RegExp(req.something);
const bar = new RegExp(variable);

Compliant Code Examples

const foo = new RegExp(`^\\d+-${topicId}$`);
const foo = new RegExp(/something/);
const foo = new RegExp("weofiwje"); jetbrains

Seamless integrations. Try Datadog Code Analysis