Modify Regex to avoid ReDoS

jmprentice · jmprentice · commit a788c4b7becf · 2022-11-10T17:11:48.000-05:00
diff --git a/lib/interpolateName.js b/lib/interpolateName.js
@@ -108,7 +108,7 @@ function interpolateName(loaderContext, name, options) {
       // `hash` and `contenthash` are same in `loader-utils` context
       // let's keep `hash` for backward compatibility
       .replace(
-        /\[(?:([^:\]]+):)?(?:hash|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,
+        /\[(?:([^\[:\]]+):)?(?:hash|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,
         (all, hashType, digestType, maxLength) =>
           getHashDigest(content, hashType, digestType, parseInt(maxLength, 10))
       )

Original file line number	Diff line number	Diff line change
`@@ -108,7 +108,7 @@ function interpolateName(loaderContext, name, options) {`
`108`	`108`	// `hash` and `contenthash` are same in `loader-utils` context
`109`	`109`	// let's keep `hash` for backward compatibility
`110`	`110`	`.replace(`
`111`		`- /\[(?:([^:\]]+):)?(?:hash\|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,`
	`111`	`+ /\[(?:([^\[:\]]+):)?(?:hash\|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,`
`112`	`112`	`(all, hashType, digestType, maxLength) =>`
`113`	`113`	`getHashDigest(content, hashType, digestType, parseInt(maxLength, 10))`
`114`	`114`	`)`