Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| myIpAddress: () => '127.0.0.1', | ||
| dnsDomainLevels: h => (h.match(/\./g) || []).length, | ||
| shExpMatch: (str, shexp) => { | ||
| const re = new RegExp('^' + shexp.replace(/\./g, '\\.').replace(/\*/g, '.*').replace(/\?/g, '.') + '$'); |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 1 day ago
In general, to fix this kind of problem you should not hand-roll escaping with a couple of replace calls. Instead, first escape all regular expression metacharacters in the input pattern, then translate only the intended wildcard characters (* and ?) into their regex equivalents, and finally compile the resulting string with new RegExp using the desired flags.
For this file, the best fix is to rewrite the construction of re in shExpMatch to:
- Escape all regex metacharacters in
shexp, including backslash. - Replace the escaped
*and?with.*and.respectively. - Wrap the final string with
^and$as before.
We can implement this directly inside _runPacScript’s sandbox.shExpMatch function without changing its external behavior or adding new imports. A common pattern is:
const escaped = shexp.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
const pattern = '^' + escaped.replace(/\\\*/g, '.*').replace(/\\\?/g, '.') + '$';
const re = new RegExp(pattern);This ensures that backslashes and all other regex meta-characters are safely escaped while still giving * and ? their wildcard semantics. Only the body of shExpMatch (lines around 364–366) in packages/cli-doctor/src/checks/pac.js needs to be changed.
| @@ -362,7 +362,10 @@ | ||
| myIpAddress: () => '127.0.0.1', | ||
| dnsDomainLevels: h => (h.match(/\./g) || []).length, | ||
| shExpMatch: (str, shexp) => { | ||
| const re = new RegExp('^' + shexp.replace(/\./g, '\\.').replace(/\*/g, '.*').replace(/\?/g, '.') + '$'); | ||
| // Escape all regex metacharacters, then translate wildcard * and ? to regex | ||
| const escaped = shexp.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); | ||
| const pattern = '^' + escaped.replace(/\\\*/g, '.*').replace(/\\\?/g, '.') + '$'; | ||
| const re = new RegExp(pattern); | ||
| return re.test(str); | ||
| }, | ||
| weekdayRange: () => true, |
1 participant
No description provided.