stealjs / steal

Gets JavaScript
https://stealjs.com
MIT License
1.37k stars 521 forks source link

[CVE-2022-37262]/ReDos found in main.js #1531

Open secdevlpr26 opened 1 year ago

secdevlpr26 commented 1 year ago

A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js.

The ReDoS vulnerability can be mitigated with several best practices described here: https://snyk.io/blog/redos-and-catastrophic-backtracking/