Skip to content

Commit b51ed27

Browse files
committed
test: ReDos regex vulnerability, reported by @dayshift
1 parent 12a14f0 commit b51ed27

File tree

1 file changed

+36
-0
lines changed

1 file changed

+36
-0
lines changed

test/request-error.test.ts

+36
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,42 @@ const mockOptions: RequestErrorOptions = {
1010
};
1111

1212
describe("RequestError", () => {
13+
test("Test ReDoS - attack string", () => {
14+
const startTime = performance.now();
15+
const error = new RequestError("Oops", 500, {
16+
request: {
17+
method: "POST",
18+
url: "https://api.github.com/foo",
19+
body: {
20+
bar: "baz",
21+
},
22+
headers: {
23+
authorization: "" + " ".repeat(100000) + "\n@",
24+
},
25+
},
26+
response: {
27+
status: 500,
28+
url: "https://api.github.com/foo",
29+
headers: {
30+
"x-github-request-id": "1:2:3:4",
31+
},
32+
data: {
33+
foo: "bar",
34+
},
35+
},
36+
});
37+
const endTime = performance.now();
38+
const elapsedTime = endTime - startTime;
39+
const reDosThreshold = 2000;
40+
expect(elapsedTime).toBeLessThanOrEqual(reDosThreshold);
41+
if (elapsedTime > reDosThreshold) {
42+
console.warn(
43+
`🚨 Potential ReDoS Attack! getDuration method took ${elapsedTime.toFixed(
44+
2,
45+
)} ms, exceeding threshold of ${reDosThreshold} ms.`,
46+
);
47+
}
48+
});
1349
test("inherits from Error", () => {
1450
const error = new RequestError("test", 123, mockOptions);
1551
expect(error).toBeInstanceOf(Error);

0 commit comments

Comments
 (0)