Open 0xPoly opened 9 years ago
As you recall from previous discussions, I'd rather avoid quoting regular expressions because the need to do that increases development complexity. I've yet to think at all the security implications, but maybe a way to do this is to use a bootstrap JavaScript file supposed to contain a dictionary mapping strings to regular expressions. Then people could refer to the keys to mean regular expressions.
Something like:
var REGEXPS = {
host: /^[A-Za-z0-9]+$/,
port: /^[0-9]+$/
};
And then a plugin could declare that it uses the host
or port
regular expressions.
Another alternative could be to supply validation functions along with plugins as I said in #11.
re: security implications, I think that any attacker that can write to disk and change the regex file could just as easily modify the application's code - I don't think this feature increases attack surface.
Some regexes are used quite often in NM plugins, such as the 'IP address or domain name' regex. NM should store these in a central location and provide an interface to access them for plugin developers.