Skip to content

Commit 29b96b4

Browse files
committed
Add backtrack protection to parameters
1 parent ac4c234 commit 29b96b4

File tree

2 files changed

+90
-40
lines changed

2 files changed

+90
-40
lines changed

index.js

+51-39
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
/**
2-
* Expose `pathtoRegexp`.
2+
* Expose `pathToRegexp`.
33
*/
44

5-
module.exports = pathtoRegexp;
5+
module.exports = pathToRegexp;
66

77
/**
88
* Match matching groups in a regular expression.
99
*/
10-
var MATCHING_GROUP_REGEXP = /\((?:\?<(.*?)>)?(?!\?)/g;
10+
var MATCHING_GROUP_REGEXP = /\\.|\((?:\?<(.*?)>)?(?!\?)/g;
1111

1212
/**
1313
* Normalize the given path string,
@@ -25,7 +25,7 @@ var MATCHING_GROUP_REGEXP = /\((?:\?<(.*?)>)?(?!\?)/g;
2525
* @api private
2626
*/
2727

28-
function pathtoRegexp(path, keys, options) {
28+
function pathToRegexp(path, keys, options) {
2929
options = options || {};
3030
keys = keys || [];
3131
var strict = options.strict;
@@ -36,10 +36,14 @@ function pathtoRegexp(path, keys, options) {
3636
var keysOffset = keys.length;
3737
var i = 0;
3838
var name = 0;
39+
var pos = 0;
40+
var backtrack = '';
3941
var m;
4042

4143
if (path instanceof RegExp) {
4244
while (m = MATCHING_GROUP_REGEXP.exec(path.source)) {
45+
if (m[0][0] === '\\') continue;
46+
4347
keys.push({
4448
name: m[1] || name++,
4549
optional: false,
@@ -55,62 +59,68 @@ function pathtoRegexp(path, keys, options) {
5559
// the same keys and options instance into every generation to get
5660
// consistent matching groups before we join the sources together.
5761
path = path.map(function (value) {
58-
return pathtoRegexp(value, keys, options).source;
62+
return pathToRegexp(value, keys, options).source;
5963
});
6064

61-
return new RegExp('(?:' + path.join('|') + ')', flags);
65+
return new RegExp(path.join('|'), flags);
6266
}
6367

64-
path = ('^' + path + (strict ? '' : path[path.length - 1] === '/' ? '?' : '/?'))
65-
.replace(/\/\(/g, '/(?:')
66-
.replace(/([\/\.])/g, '\\$1')
67-
.replace(/(\\\/)?(\\\.)?:(\w+)(\(.*?\))?(\*)?(\?)?/g, function (match, slash, format, key, capture, star, optional, offset) {
68+
path = path.replace(
69+
/\\.|(\/)?(\.)?:(\w+)(\(.*?\))?(\*)?(\?)?|[.*]|\/\(/g,
70+
function (match, slash, format, key, capture, star, optional, offset) {
71+
pos = offset + match.length;
72+
73+
if (match[0] === '\\') {
74+
backtrack += match;
75+
return match;
76+
}
77+
78+
if (match === '.') {
79+
backtrack += '\\.';
80+
extraOffset += 1;
81+
return '\\.';
82+
}
83+
84+
backtrack = slash || format ? '' : path.slice(pos, offset);
85+
86+
if (match === '*') {
87+
extraOffset += 3;
88+
return '(.*)';
89+
}
90+
91+
if (match === '/(') {
92+
backtrack += '/';
93+
extraOffset += 2;
94+
return '/(?:';
95+
}
96+
6897
slash = slash || '';
69-
format = format || '';
70-
capture = capture || '([^\\/' + format + ']+?)';
98+
format = format ? '\\.' : '';
7199
optional = optional || '';
100+
capture = capture ?
101+
capture.replace(/\\.|\*/, function (m) { return m === '*' ? '(.*)' : m; }) :
102+
(backtrack ? '((?:(?!/|' + backtrack + ').)+?)' : '([^/' + format + ']+?)');
72103

73104
keys.push({
74105
name: key,
75106
optional: !!optional,
76107
offset: offset + extraOffset
77108
});
78109

79-
var result = ''
80-
+ (optional ? '' : slash)
81-
+ '(?:'
82-
+ format + (optional ? slash : '') + capture
83-
+ (star ? '((?:[\\/' + format + '].+?)?)' : '')
110+
var result = '(?:'
111+
+ format + slash + capture
112+
+ (star ? '((?:[/' + format + '].+?)?)' : '')
84113
+ ')'
85114
+ optional;
86115

87116
extraOffset += result.length - match.length;
88117

89118
return result;
90-
})
91-
.replace(/\*/g, function (star, index) {
92-
var len = keys.length
93-
94-
while (len-- > keysOffset && keys[len].offset > index) {
95-
keys[len].offset += 3; // Replacement length minus asterisk length.
96-
}
97-
98-
return '(.*)';
99119
});
100120

101121
// This is a workaround for handling unnamed matching groups.
102122
while (m = MATCHING_GROUP_REGEXP.exec(path)) {
103-
var escapeCount = 0;
104-
var index = m.index;
105-
106-
while (path.charAt(--index) === '\\') {
107-
escapeCount++;
108-
}
109-
110-
// It's possible to escape the bracket.
111-
if (escapeCount % 2 === 1) {
112-
continue;
113-
}
123+
if (m[0][0] === '\\') continue;
114124

115125
if (keysOffset + i === keys.length || keys[keysOffset + i].offset > m.index) {
116126
keys.splice(keysOffset + i, 0, {
@@ -123,12 +133,14 @@ function pathtoRegexp(path, keys, options) {
123133
i++;
124134
}
125135

136+
path += strict ? '' : path[path.length - 1] === '/' ? '?' : '/?';
137+
126138
// If the path is non-ending, match until the end or a slash.
127139
if (end) {
128140
path += '$';
129141
} else if (path[path.length - 1] !== '/') {
130-
path += lookahead ? '(?=\\/|$)' : '(?:\/|$)';
142+
path += lookahead ? '(?=/|$)' : '(?:/|$)';
131143
}
132144

133-
return new RegExp(path, flags);
145+
return new RegExp('^' + path, flags);
134146
};

test.js

+39-1
Original file line numberDiff line numberDiff line change
@@ -763,6 +763,44 @@ describe('path-to-regexp', function () {
763763
assert.equal(m[0], '/test.json');
764764
assert.equal(m[1], 'test.json');
765765
});
766+
767+
it('should match after a non-slash or format character', function () {
768+
var params = [];
769+
var re = pathToRegExp('/:x-:y', params);
770+
var m;
771+
772+
assert.equal(params.length, 2);
773+
assert.equal(params[0].name, 'x');
774+
assert.equal(params[0].optional, false);
775+
assert.equal(params[1].name, 'y');
776+
assert.equal(params[1].optional, false);
777+
778+
m = re.exec('/1-2');
779+
780+
assert.equal(m.length, 3);
781+
assert.equal(m[0], '/1-2');
782+
assert.equal(m[1], '1');
783+
assert.equal(m[2], '2');
784+
});
785+
786+
it('should replace asterisk in capture group', function () {
787+
var params = [];
788+
var re = pathToRegExp('/files/:file(*)', params);
789+
var m;
790+
791+
assert.equal(params.length, 2);
792+
assert.equal(params[0].name, 'file');
793+
assert.equal(params[0].optional, false);
794+
assert.equal(params[1].name, 0);
795+
assert.equal(params[1].optional, false);
796+
797+
m = re.exec('/files/test');
798+
799+
assert.equal(m.length, 3);
800+
assert.equal(m[0], '/files/test');
801+
assert.equal(m[1], 'test');
802+
assert.equal(m[2], 'test');
803+
})
766804
});
767805

768806
describe('regexps', function () {
@@ -812,7 +850,7 @@ describe('path-to-regexp', function () {
812850
assert.equal(m[1], 'foo');
813851
assert.equal(m[2], 'bar');
814852
assert.equal(m[3], 'baz');
815-
})
853+
});
816854
});
817855

818856
describe('arrays', function () {

0 commit comments

Comments
 (0)