fix: 存在潜在的 ReDoS 漏洞或低效正则表达式 #17619
Open
fix: 存在潜在的 ReDoS 漏洞或低效正则表达式 #17619
+23
−3
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Poem
|
This was referenced May 3, 2025
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
packages/css-to-react-native/__tests__/index.spec.js (4)
3641-3641: 建议遵循项目的分号使用规范根据静态分析提示，此行有多余的分号。虽然这不影响功能，但建议保持代码风格一致性。
- jest.setTimeout(1000); + jest.setTimeout(1000)🧰 Tools
🪛 ESLint
[error] 3641-3641: Extra semicolon.
(semi)
3642-3644: 建议移除多余的空行根据静态分析提示，代码块不应该有空行填充。建议移除块内的空行以保持代码风格一致性。
it('should finish transform of 100k zeros + "p" in under 1s', () => { - const bigValue = '0'.repeat(100000) + 'p'; + + const bigValue = '0'.repeat(100000) + 'p'🧰 Tools
🪛 ESLint
[error] 3642-3644: Block must not be padded by blank lines.
(padded-blocks)
[error] 3644-3644: Extra semicolon.
(semi)
3651-3656: 建议统一移除末尾分号，保持代码风格一致根据静态分析提示，这些行有多余的分号。为保持代码风格一致性，建议移除。
- const start = performance.now(); + const start = performance.now() transform(cssString, { scalable: false, parseMediaQueries: false - }); - const duration = performance.now() - start; - expect(duration).toBeLessThan(1000); + }) + const duration = performance.now() - start + expect(duration).toBeLessThan(1000)🧰 Tools
🪛 ESLint
[error] 3654-3654: Extra semicolon.
(semi)
[error] 3655-3655: Extra semicolon.
(semi)
[error] 3656-3656: Extra semicolon.
(semi)
3640-3657: 性能测试策略是有效的，但可以考虑更全面的测试方法这个测试有效验证了修复后的正则表达式对潜在 ReDoS 攻击的防御能力。不过，考虑到正则表达式的复杂性，可以添加更多边缘情况的测试，如不同模式的重复字符或特殊字符组合，以确保修复的全面性。
可以考虑添加多种类型的潜在恶意输入测试，例如：
- 带有大量重复字符的边缘情况
- 具有不同模式重复的字符串
- 包含正则表达式中特殊字符的长字符串
这将使测试更加全面，确保正则表达式优化在各种情况下都有效。
🧰 Tools
🪛 ESLint
[error] 3641-3641: Extra semicolon.
(semi)
[error] 3642-3644: Block must not be padded by blank lines.
(padded-blocks)
[error] 3644-3644: Extra semicolon.
(semi)
[error] 3648-3648: Extra semicolon.
(semi)
[error] 3650-3650: Extra semicolon.
(semi)
[error] 3654-3654: Extra semicolon.
(semi)
[error] 3655-3655: Extra semicolon.
(semi)
[error] 3656-3656: Extra semicolon.
(semi)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
packages/css-to-react-native/__tests__/index.spec.js(1 hunks)packages/css-to-react-native/src/index.js(1 hunks)packages/css-to-react-native/src/transforms/rem.js(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
- packages/css-to-react-native/src/index.js
- packages/css-to-react-native/src/transforms/rem.js
🧰 Additional context used
🪛 ESLint
packages/css-to-react-native/__tests__/index.spec.js
[error] 3641-3641: Extra semicolon.
(semi)
[error] 3642-3644: Block must not be padded by blank lines.
(padded-blocks)
[error] 3644-3644: Extra semicolon.
(semi)
[error] 3648-3648: Extra semicolon.
(semi)
[error] 3650-3650: Extra semicolon.
(semi)
[error] 3654-3654: Extra semicolon.
(semi)
[error] 3655-3655: Extra semicolon.
(semi)
[error] 3656-3656: Extra semicolon.
(semi)
🔇 Additional comments (1)
packages/css-to-react-native/__tests__/index.spec.js (1)
3639-3658: 新增的 ReDos 测试套件有效验证了正则表达式优化这个测试套件很好地验证了正则表达式优化的效果，确保处理极大数值（10万个零后跟"p"）的性能在1秒内完成。这与PR中修复的潜在ReDoS漏洞直接相关，是一个很好的回归测试。
🧰 Tools
🪛 ESLint
[error] 3641-3641: Extra semicolon.
(semi)
[error] 3642-3644: Block must not be padded by blank lines.
(padded-blocks)
[error] 3644-3644: Extra semicolon.
(semi)
[error] 3648-3648: Extra semicolon.
(semi)
[error] 3650-3650: Extra semicolon.
(semi)
[error] 3654-3654: Extra semicolon.
(semi)
[error] 3655-3655: Extra semicolon.
(semi)
[error] 3656-3656: Extra semicolon.
(semi)
|
@mmmsssttt404 同学修复一下 lint 问题 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
这个 PR 做了什么? (简要描述所做更改)
报告项目中潜在正则表达式拒绝服务 （ReDoS） 漏洞或低效的正则表达式。在上下文中使用特制的输入字符串时，可能会导致极高的 CPU 使用率、应用程序冻结或拒绝服务攻击。
taro/packages/css-to-react-native/src/index.js
Line 62 in d28acca
taro/packages/css-to-react-native/src/transforms/rem.js
Line 2 in d28acca
将正则改为
https://github.com/mmmsssttt404/taro/blob/196bc7a5b880890c3894c85c37977098bb75c5dd/packages/css-to-react-native/src/index.js#L62
https://github.com/mmmsssttt404/taro/blob/e41414ff8e402e8366bf3476fc658ce470bcd21b/packages/css-to-react-native/src/transforms/rem.js#L2
改之前 测试指令后程序一直运行
改之后
步骤
1.git clone https://gitclone.com/github.com/mmmsssttt404/taro.git
2.cd tero
3.pnpm i
4.pnpm build
5.pnpm --filter taro-css-to-react-native test
这个 PR 是什么类型? (至少选择一个)
这个 PR 涉及以下平台:
Summary by CodeRabbit