search

coverlet-coverage / coverlet

Cross platform code coverage for .NET
MIT License
2.93k stars 385 forks source link

Add regex evaluation timeout #1630

Closed mokarchi closed 4 months ago

mokarchi commented 4 months ago

Regex - Deny of Service (ReDoS)

MarcoRossignoli commented 4 months ago

I don't think we need this anti-DoS timeout...the inputs are under the control of the user that's using coverlet and not from "unknown users" like in case of a web app. But if we want to add if in case someone is using it under some other tool where users can add arbitrary input we should at least increase a bit, 1 sec looks too few to me, we could put 10.

mokarchi commented 4 months ago

@MarcoRossignoli Changed to 10 seconds