ReDoS in is-it-check in evdama/is-it-check

Valid

Reported on

Mar 19th 2022


✍️ Description

It allows causing a denial of service when checking crafted invalid URLs.

🕵️‍♂️ Proof of Concept

// PoC.js
var isItCheck = require("is-it-check")
isItCheck.url('H'+'.A8'.repeat(40))
We are processing your report and will contact the evdama/is-it-check team within 24 hours. 2 months ago
We have contacted a member of the evdama/is-it-check team and are waiting to hear back 2 months ago
Markus
2 months ago

Maintainer


Two possible solutions, a) add a str.length() check or b) modify existing regex with a length check. Would you mind sending a PR to https://github.com/evdama/is-it-check ?

Markus validated this vulnerability 2 months ago
Yeting Li has been awarded the disclosure bounty
The fix bounty is now up for grabs
Markus confirmed that a fix has been merged on d60d34 2 months ago
Markus has been awarded the fix bounty
to join this conversation