search

sasstools / scss-tokenizer

A tokenzier for Sass' SCSS syntax
MIT License
24 stars 22 forks source link

CVE-2021-23382 Might apply? #45

Closed prb112 closed 2 years ago

prb112 commented 2 years ago

Dear SCSS-Tokenizer Team,

In scanning my node_modules for Regular Expression Denial of Service (ReDoS) Affecting org.webjars.npm:postcss and CVE-2021-23382

I encountered scss-tokenizer with previous-map.js with the same style regular expression that is cited in the CVE commit.

postcss

    return sourceMapString.match(/\/\*\s*# sourceMappingURL=(.*)\*\//)[1].trim()

scss-tokenizer

let match = css.match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//)

It's slightly different, and maybe worth your time to double check.

I hope this helps.

Dipenduroy commented 2 years ago

Do we have any blockers to merge the PR? Awaiting the CVE fix

xzyfer commented 2 years ago

Fixed in v0.4.3