Potential regular expression denial of service (ReDoS)

[luciddr34m3r]

Imported from upstream, reported by mkienow-r7.

prefix is controllable by the caller and could result in a regular expression denial of service (ReDoS).

• api/routes/credentials.js:

_id: {$regex: new RegExp('^' + prefix, 'i')}

• api/routes/dictionary.js:

_id: {$regex: new RegExp('^' + prefix, 'i')}

[luciddr34m3r]

Need to do input validation on the prefix field. Probably should just be restricted to characters that are valid for the grammar, which can be found in the CPE documentation.

A dep like Yup might be what we want to get this fixed.