feat: add transformWin32RelativePath#15
Conversation
cfa3a99 to
cbe265e
Compare
|
|
||
| export function normalizeWin32RelativePath(p: string): string { | ||
| return p.replace( | ||
| /(['"`])(\.\.([\\/]))+([\w-]+\3)+[^\\/]*\1/g, |
There was a problem hiding this comment.
Oh, this was just my temporary workaround for that issue, it didn't cover one level sibling relative path: ./.
| /(['"`])(\.\.([\\/]))+([\w-]+\3)+[^\\/]*\1/g, | |
| /(['"`])(\.\.?([\\/]))+([\w-]+\3?)+[^\\/]*\1/g, |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ession Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…ession Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
| return p.replace( | ||
| /(['"`])(\.\.?([\\/]))+((?:[^\W_]|-)+\3?)+[^\\/]*\1/g, | ||
| (match: string) => { | ||
| return match.replace(/\\/g, '/'); | ||
| }, | ||
| ); |
Check failure
Code scanning / CodeQL
Polynomial regular expression used on uncontrolled data
|
|
||
| export function normalizeWin32RelativePath(p: string): string { | ||
| return p.replace( | ||
| /(['"`])(\.\.?([\\/]))+((?:[^\W_]|-)+\3?)+[^\\/]*\1/g, |
Check failure
Code scanning / CodeQL
Inefficient regular expression
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the issue, we need to remove the ambiguity in the regular expression. The problematic part (?:[^\W_]|-)+ can be rewritten to explicitly match either alphanumeric characters or hyphens without ambiguity. This can be achieved by replacing [^\W_] with a more specific character class, such as [a-zA-Z0-9], and ensuring that the hyphen - is handled separately. The updated regular expression will avoid exponential backtracking while maintaining the intended functionality.
The specific change will be made on line 24 of src/normalize.ts.
| @@ -23,3 +23,3 @@ | ||
| return p.replace( | ||
| /(['"`])(\.\.?([\\/]))+((?:[^\W_]|-)+\3?)+[^\\/]*\1/g, | ||
| /(['"`])(\.\.?([\\/]))+([a-zA-Z0-9-]+\3?)+[^\\/]*\1/g, | ||
| (match: string) => { |
3 participants
close #10