Emergency fix for ReDoS vulnerability

davewasmer / devcert

Local HTTPS development made easy

1.28k stars 75 forks source link

Closed zetlen closed 2 years ago

zetlen commented 2 years ago

VALID_DOMAIN regex had exponential-time vulnerability on certain strings.

Switched from vulnerable VALID_DOMAIN regex to is-valid-domain lib, which uses a known list of TLDs.

mcalthrop-lego commented 2 years ago

Hi @zetlen

Could you elaborate on the reason for disallowing subdomains?

This used to work well in our setup, and now does not, as we require certificate generation for subdomains.

From what I can see, this should not affect the ReDoS issue the original PR mitigates.

NewFuture commented 2 years ago

@zetlen @davewasmer it breaks subdomain 😮

drmcclelland commented 2 years ago

I think this change also also broke "localhost"...

mcalthrop-lego commented 2 years ago

@zetlen Any thoughts on this?