fixup! TF-4224 Reduce ReDoS vulnerability

This commit is contained in:
Dang Dat
2026-01-05 14:58:18 +07:00
committed by Dat H. Pham
parent 8e0276114e
commit 782d21d796
+7 -15
View File
@@ -65,7 +65,7 @@ void main() {
}); });
}); });
group('NormalizeLineHeightInStyleTransformer', () { group('NormalizeLineHeightInStyleTransformer tests regex patterns in isolation', () {
test('should handle very long style strings efficiently', () { test('should handle very long style strings efficiently', () {
final longStyle = 'color: red; ' * 10000 + 'line-height: 1px;'; final longStyle = 'color: red; ' * 10000 + 'line-height: 1px;';
@@ -447,16 +447,16 @@ void main() {
}); });
group('AppUtils._emailLocalhostRegex', () { group('AppUtils._emailLocalhostRegex', () {
final localhostRegex = RegExp(
r'^(?:"[^"\r\n]+"|[^<>()[\]\\.,;:\s@"]+(?:\.[^<>()[\]\\.,;:\s@"]+)*)@localhost$',
);
test('should handle very long email addresses efficiently', () { test('should handle very long email addresses efficiently', () {
final longEmail = '${'a' * 10000}@localhost'; final longEmail = '${'a' * 10000}@localhost';
final stopwatch = Stopwatch()..start(); final stopwatch = Stopwatch()..start();
// Note: We can't directly test AppUtils.isEmailLocalhost in core tests // Note: We can't directly test AppUtils.isEmailLocalhost in core tests
// But we can test the regex pattern // But we can test the regex pattern
final regex = RegExp( final result = localhostRegex.hasMatch(longEmail);
r'^(?:"[^"\r\n]+"|[^<>()[\]\\.,;:\s@"]+(?:\.[^<>()[\]\\.,;:\s@"]+)*)@localhost$',
);
final result = regex.hasMatch(longEmail);
stopwatch.stop(); stopwatch.stop();
expect(stopwatch.elapsedMilliseconds, lessThan(100)); expect(stopwatch.elapsedMilliseconds, lessThan(100));
@@ -464,10 +464,6 @@ void main() {
}); });
test('should correctly match valid localhost emails', () { test('should correctly match valid localhost emails', () {
final regex = RegExp(
r'^(?:"[^"\r\n]+"|[^<>()[\]\\.,;:\s@"]+(?:\.[^<>()[\]\\.,;:\s@"]+)*)@localhost$',
);
const validEmails = [ const validEmails = [
'user@localhost', 'user@localhost',
'user.name@localhost', 'user.name@localhost',
@@ -475,16 +471,12 @@ void main() {
]; ];
for (final email in validEmails) { for (final email in validEmails) {
expect(regex.hasMatch(email.trim()), isTrue, expect(localhostRegex.hasMatch(email.trim()), isTrue,
reason: 'Should match: $email'); reason: 'Should match: $email');
} }
}); });
test('should reject invalid localhost emails', () { test('should reject invalid localhost emails', () {
final regex = RegExp(
r'^(?:"[^"\r\n]+"|[^<>()[\]\\.,;:\s@"]+(?:\.[^<>()[\]\\.,;:\s@"]+)*)@localhost$',
);
const invalidEmails = [ const invalidEmails = [
'user@localhost.com', 'user@localhost.com',
'@localhost', '@localhost',
@@ -493,7 +485,7 @@ void main() {
]; ];
for (final email in invalidEmails) { for (final email in invalidEmails) {
expect(regex.hasMatch(email.trim()), isFalse, expect(localhostRegex.hasMatch(email.trim()), isFalse,
reason: 'Should not match: $email'); reason: 'Should not match: $email');
} }
}); });