search

zkat / ssri

Standard Subresource Integrity library for Node.js
Other
82 stars 13 forks source link

fix(security): tweak strict SRI regex #10

Closed zkat closed 6 years ago

zkat commented 6 years ago

The previous form was vulnerable to ReDoS attacks, by crafting exceptionally long base64 hash strings.

This issue only affected consumers using the opts.strict option.

ThisIsMissEm commented 6 years ago

huh, cool, Github just alerted me to this issue in one of my projects, turns out there's even a CVE for it: https://nvd.nist.gov/vuln/detail/CVE-2018-7651