How to check that my Regex is safe: Unsafe Regular Expressioneslintsecurity/detect-unsafe-regex

huangapple go评论76阅读模式
英文:

How to check that my Regex is safe: Unsafe Regular Expressioneslintsecurity/detect-unsafe-regex

问题


export const isFloat = (value: string) => {
    const pattern = /^[+-]?([0-9]+([,][0-9]*)?|[,][0-9]+)$/;
    return pattern.test(value);
};


module.exports = {
    root: true,
    parserOptions: {
        ecmaVersion: 2020,
        sourceType: "module",
        ecmaFeatures: {
            jsx: true,
        },
    },

    env: {
        browser: true,
        node: true,
        es6: true,
    },

    settings: {
        react: {
            version: "detect",
        },
        "import/resolver": {
            node: {
                extensions: [".ts", ".tsx"],
            },
        },
    },

    plugins: ["@typescript-eslint"],
    extends: [
        "next/core-web-vitals",
        "plugin:@typescript-eslint/recommended",
        "airbnb",
        "prettier",
        "plugin:jsx-a11y/recommended",
        "plugin:prettier/recommended",
        "plugin:sonarjs/recommended",
        "plugin:security/recommended", // this one
    ],

    rules: {
        "@typescript-eslint/no-unused-vars": "error",
        "@typescript-eslint/no-explicit-any": "error",
        "@typescript-eslint/explicit-function-return-type": "off",
        "react/react-in-jsx-scope": "off",
        "react/jsx-filename-extension": [
            1,
            {
                extensions: [".ts", ".tsx"],
            },
        ],
        "react/jsx-props-no-spreading": "off",
        "import/extensions": [
            "error",
            "ignorePackages",
            {
                js: "never",
                jsx: "never",
                ts: "never",
                tsx: "never",
            },
        ],
        "jsx-a11y/anchor-is-valid": [
            "error",
            {
                components: ["Link"],
                specialLink: ["hrefLeft", "hrefRight"],
                aspects: ["invalidHref", "preferButton"],
            },
        ],
        "no-nested-ternary": "off",
        "import/prefer-default-export": "off",
    },
};

英文:

I have a helper that checks if a value is float or not ( German numbers have commas instead of dots ):


export const isFloat = (value: string) => {
    const pattern = /^[+-]?([0-9]+([,][0-9]*)?|[,][0-9]+)$/;
    return pattern.test(value);
};

However, Eslint shows me this error:

How to check that my Regex is safe: Unsafe Regular Expressioneslintsecurity/detect-unsafe-regex

Is it safe to ignore this rule?

Or should I fix my pattern? How to check that my regex is safe?

EDIT 1 ( The Fourth Bird comment )

How to check that my Regex is safe: Unsafe Regular Expressioneslintsecurity/detect-unsafe-regex

EDIT2:

I also, that my colleague's function has the same warning!
How to check that my Regex is safe: Unsafe Regular Expressioneslintsecurity/detect-unsafe-regex

This is my eslint configuration:


module.exports = {
    root: true,
    parserOptions: {
        ecmaVersion: 2020,
        sourceType: "module",
        ecmaFeatures: {
            jsx: true,
        },
    },

    env: {
        browser: true,
        node: true,
        es6: true,
    },

    settings: {
        react: {
            version: "detect",
        },
        "import/resolver": {
            node: {
                extensions: [".ts", ".tsx"],
            },
        },
    },

    plugins: ["@typescript-eslint"],
    extends: [
        "next/core-web-vitals",
        "plugin:@typescript-eslint/recommended",
        "airbnb",
        "prettier",
        "plugin:jsx-a11y/recommended",
        "plugin:prettier/recommended",
        "plugin:sonarjs/recommended",
        "plugin:security/recommended", // this one
    ],

    rules: {
        "@typescript-eslint/no-unused-vars": "error",
        "@typescript-eslint/no-explicit-any": "error",
        "@typescript-eslint/explicit-function-return-type": "off",
        "react/react-in-jsx-scope": "off",
        "react/jsx-filename-extension": [
            1,
            {
                extensions: [".ts", ".tsx"],
            },
        ],
        "react/jsx-props-no-spreading": "off",
        "import/extensions": [
            "error",
            "ignorePackages",
            {
                js: "never",
                jsx: "never",
                ts: "never",
                tsx: "never",
            },
        ],
        "jsx-a11y/anchor-is-valid": [
            "error",
            {
                components: ["Link"],
                specialLink: ["hrefLeft", "hrefRight"],
                aspects: ["invalidHref", "preferButton"],
            },
        ],
        "no-nested-ternary": "off",
        "import/prefer-default-export": "off",
    },
};

答案1

得分: 1

以下是翻译好的部分:

  • ^[+-]?:可选匹配 +-
  • (?![\d,]*,,):负向先行断言,确保不匹配 ,,
  • (?![\d,]*,$):不匹配字符串末尾的 ,
  • (?!,\d+,):不匹配 , 然后是数字和另一个 ,
  • ,*\d[\d,]*:匹配可选的 ,,然后至少匹配一个数字,然后可选的数字或 ,
  • $:字符串的结束
英文:

Instead of nesting the quantifier in a repeating group while matching, you can start the pattern with negative assertions to exclude what is not allowed and then match at least a single digit:

^[+-]?(?![\d,]*,,)(?![\d,]*,$)(?!,\d+,),*\d[\d,]*$
  • ^[+-]? Optionally match + or -
  • (?![\d,]*,,) Negative lookahead, assert not ,,
  • (?![\d,]*,$) Not , at the end of the string
  • (?!,\d+,) Not , then digits and another ,
  • ,*\d[\d,]* Match optional , followed by at least a single digit and then optional digits or ,
  • $ End of string

Regex demo

const safe = require('safe-regex');
const regex = /^[+-]?(?![\d,]*,,)(?![\d,]*,$)(?!,\d+,),*\d[\d,]*$/;
console.log(safe(regex));
// Output true

huangapple
  • 本文由 发表于 2023年8月4日 01:04:10
  • 转载请务必保留本文链接:https://go.coder-hub.com/76830212.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定