Security: Fix typeRefRe being vulnerable to ReDoS

protobufjs · Feb 26, 2018 · 2ee1028 · 2ee1028
1 parent b912005
commit 2ee1028
Show file tree

Hide file tree

Showing 10 changed files with 20 additions and 20 deletions.
diff --git a/dist/light/protobuf.js b/dist/light/protobuf.js
diff --git a/dist/light/protobuf.min.js b/dist/light/protobuf.min.js
diff --git a/dist/minimal/protobuf.js b/dist/minimal/protobuf.js
diff --git a/dist/minimal/protobuf.min.js b/dist/minimal/protobuf.min.js
diff --git a/dist/protobuf.js b/dist/protobuf.js
diff --git a/dist/protobuf.js.map b/dist/protobuf.js.map
diff --git a/dist/protobuf.min.js b/dist/protobuf.min.js
diff --git a/dist/protobuf.min.js.map b/dist/protobuf.min.js.map
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "protobufjs",
-  "version": "6.8.5",
+  "version": "6.8.6",
   "versionScheme": "~",
   "description": "Protocol Buffers for JavaScript (& TypeScript).",
   "author": "Daniel Wirtz <dcode+protobufjs@dcode.io>",

diff --git a/src/parse.js b/src/parse.js
@@ -24,8 +24,8 @@ var base10Re    = /^[1-9][0-9]*$/,
     base8NegRe  = /^-?0[0-7]+$/,
     numberRe    = /^(?![eE])[0-9]*(?:\.[0-9]*)?(?:[eE][+-]?[0-9]+)?$/,
     nameRe      = /^[a-zA-Z_][a-zA-Z_0-9]*$/,
-    typeRefRe   = /^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)+$/,
-    fqTypeRefRe = /^(?:\.[a-zA-Z][a-zA-Z_0-9]*)+$/;
+    typeRefRe   = /^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)(?:\.[a-zA-Z_][a-zA-Z_0-9]*)*$/,
+    fqTypeRefRe = /^(?:\.[a-zA-Z_][a-zA-Z_0-9]*)+$/;
 
 /**
  * Result object returned from {@link parse}.