opencybersecurityalliance / cacao-roaster

A web application for generating, parsing and validating, manipulating, and visualizing CACAO v2.0 playbooks.
Other
18 stars 7 forks source link

URL regex in schema blocks valid urls and allows invalid urls #35

Open hidde-jan opened 1 month ago

hidde-jan commented 1 month ago

The URL regex is both too restrictive and too lenient.

It does not consider domain names without a TLD valid, which are used in both docker and kubernetes, e.g. http://my-internal-api/some-path. It also doesn't allow an URL that contains an ip: http://127.0.0.1:3000 or http://localhost:3000. Both examples are very common, especially during development.

At the same time, the following url is considered valid: http://.com/

My suggestion is choose a different regex.