Skip to content

Commit d12c29b

Browse files
committed
Disable security/detect-es-literal-regexp eslint rule
see: - https://github.com/gkouziik/eslint-plugin-security-node/blob/master/docs/rules/non-literal-reg-expr.md Assessment: The Delivery-Dashboard does not use server-side resources for regex evaluation, hence an attack which would lead to an outstanding amount of CPU usage would not cause any harm.
1 parent 4672f4f commit d12c29b

File tree

3 files changed

+2
-1
lines changed

3 files changed

+2
-1
lines changed

eslint.config.mjs

+1
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ export default [
2626
'eol-last': ['warn'],
2727
'jsx-a11y/no-autofocus': ['off'],
2828
'security/detect-object-injection': ['off'],
29+
'security/detect-non-literal-regexp': ['off'],
2930
},
3031

3132
settings: {

eslint.sast.config.mjs

+1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ export default [
1010
{
1111
rules: {
1212
'security/detect-object-injection': ['off'],
13+
'security/detect-non-literal-regexp': ['off'],
1314
},
1415

1516
settings: {

src/findings.js

-1
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,6 @@ const filterMatchesOcmNode = ({
316316
if (!patterns?.length > 0) return true
317317
if (!string) return filter.semantics === FILTER_SEMANTICS.INCLUDE
318318

319-
// eslint-disable-next-line security/detect-non-literal-regexp
320319
return Boolean(patterns.find((pattern) => (new RegExp(pattern)).test(string)))
321320
}
322321

0 commit comments

Comments
 (0)