chore(deps): update dependency path-to-regexp@<0.1.13 to v1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
path-to-regexp@<0.1.13	0.2.5 → 1.9.0

GitHub Vulnerability Alerts

CVE-2024-45296

Impact

A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b.

Patches

For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

These versions add backtrack protection when a custom regex pattern is not provided:

• 0.1.10
• 1.9.0
• 3.3.0
• 6.3.0

They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.

Version 7.1.0 can enable strict: true and get an error when the regular expression might be bad.

Version 8.0.0 removes the features that can cause a ReDoS.

Workarounds

All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b to /:a-:b([^-/]+).

If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.

Details

Using /:a-:b will produce the regular expression /^\/([^\/]+?)-([^\/]+?)\/?$/. This can be exploited by a path such as /a${'-a'.repeat(8_000)}/a. OWASP has a good example of why this occurs, but the TL;DR is the /a at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the :a-:b on the repeated 8,000 -a.

Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.

References

• OWASP
• Detailed blog post

---

Release Notes

pillarjs/path-to-regexp (path-to-regexp@<0.1.13)

v1.9.0: Fix backtracking in 1.x

Compare Source

Fixed

• Add backtrack protection to 1.x release (#​320) 925ac8e
• Fix re.exec(&#​39;/test/route&#​39;) result (#​267) 32a14b0

v1.8.0: Backport token to function options

Compare Source

Added

• Backport TokensToFunctionOptions

v1.7.0

Compare Source

• Allow a delimiter option to be passed in with tokensToRegExp which will be used for "non-ending" token match situations

v1.6.0

Compare Source

• Populate RegExp.keys when using the tokensToRegExp method (making it consistent with the main export)
• Allow a delimiter option to be passed in with parse
• Updated TypeScript definition with Keys and Options updated

v1.5.3

Compare Source

• Add \\ to the ignore character group to avoid backtracking on mismatched parens

v1.5.2

Compare Source

• Escape \\ in string segments of regexp

v1.5.1

Compare Source

• Add index.d.ts to NPM package

v1.5.0

Compare Source

• Handle partial token segments (better)
• Allow compile to handle asterisk token segments

v1.4.0

Compare Source

• Handle RegExp unions in path matching groups

v1.3.0

Compare Source

• Clarify README language and named parameter token support
• Support advanced Closure Compiler with type annotations
• Add pretty paths options to compiled function output
• Add TypeScript definition to project
• Improved prefix handling with non-complete segment parameters (E.g. /:foo?-bar)

v1.2.1

Compare Source

• Encode values before validation with path compilation function
• More examples of using compilation in README

v1.2.0

Compare Source

• Add support for matching an asterisk (*) as an unnamed match everything group ((.*))

v1.1.1

Compare Source

• Expose methods for working with path tokens

v1.1.0

Compare Source

• Expose the parser implementation to consumers
• Implement a compiler function to generate valid strings
• Huge refactor of tests to be more DRY and cover new parse and compile functions
• Use chai in tests
• Add .editorconfig

v1.0.3

Compare Source

• Optimised function runtime
• Added files to package.json

v1.0.2

Compare Source

• Use Array.isArray shim
• Remove ES5 incompatible code
• Fixed repository path
• Added new readme badges

v1.0.1

Compare Source

• Ensure installation works correctly on 0.8

v1.0.0

Compare Source

• No more API changes

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[alwaysmeticulous]

✅ Meticulous spotted 0 visual differences across 256 screens tested: view results.

Meticulous evaluated ~4 hours of user flows against your PR.

_{Expected differences? Click here. Last updated for commit bcf94c6 chore(deps): update dependency path-to-regexp@<0.1.13 to v1 [security]. This comment will update as new commits are pushed.}