eduvia/workavia-mail-front
11
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fixup! TF-4224 Reduce ReDoS vulnerability

Browse Source
This commit is contained in:
Dang Dat
2026-01-05 16:42:23 +07:00
committed by Dat H. Pham
parent 9f1373c7e5
commit 7b8e95de9a
2 changed files with 8 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/lib/utils/string_convert.dart
+1 -1
View File
@@ -181,7 +181,7 @@ class StringConvert {
input = Uri.decodeComponent(input); input = Uri.decodeComponent(input);
} }
if (input.length % 4 == 0 && _base64ValidationRegex.hasMatch(input)) { if (input.length % 4 == 0 && !input.contains(' ') && _base64ValidationRegex.hasMatch(input)) {
try { try {
input = utf8.decode(base64.decode(input)); input = utf8.decode(base64.decode(input));
} catch (_) {} } catch (_) {}
core/test/utils/redos_vulnerability_test.dart
+7 -12
View File
@@ -474,7 +474,7 @@ void main() {
test('Should handle emails with special characters - valid cases', () { test('Should handle emails with special characters - valid cases', () {
// Valid emails that should be extracted successfully // Valid emails that should be extracted successfully
final validEmailInputs = { final validEmailInputs = <String, String>{
'user+tag@example.com': 'user+tag@example.com', 'user+tag@example.com': 'user+tag@example.com',
'user.name@example.com': 'user.name@example.com', 'user.name@example.com': 'user.name@example.com',
'user_name@example.com': 'user_name@example.com', 'user_name@example.com': 'user_name@example.com',
@@ -487,12 +487,12 @@ void main() {
'user@例え.jp': 'user@例え.jp', 'user@例え.jp': 'user@例え.jp',
'${'a' * 64}@example.com': '${'a' * 64}@example.com', '${'a' * 64}@example.com': '${'a' * 64}@example.com',
'Contact us at support@example.com for help': 'support@example.com', 'Contact us at support@example.com for help': 'support@example.com',
'Multiple emails: alice@test.com, bob@test.org': contains('alice@test.com'), 'Multiple emails: alice@test.com, bob@test.org': 'alice@test.com',
}; };
for (final entry in validEmailInputs.entries) { for (final entry in validEmailInputs.entries) {
final input = entry.key; final input = entry.key;
final expectedMatch = entry.value; final expectedEmail = entry.value;
final stopwatch = Stopwatch()..start(); final stopwatch = Stopwatch()..start();
final result = StringConvert.extractEmailAddress(input); final result = StringConvert.extractEmailAddress(input);
@@ -501,13 +501,8 @@ void main() {
expect(stopwatch.elapsedMilliseconds, lessThan(100), expect(stopwatch.elapsedMilliseconds, lessThan(100),
reason: 'Should process quickly: $input'); reason: 'Should process quickly: $input');
if (expectedMatch is String) { expect(result, contains(expectedEmail),
expect(result, contains(expectedMatch), reason: 'Should extract "$expectedEmail" from: $input');
reason: 'Should extract "$expectedMatch" from: $input');
} else {
expect(result, expectedMatch,
reason: 'Should match expected pattern from: $input');
}
} }
}); });
@@ -658,8 +653,8 @@ void main() {
StringConvert.extractEmailAddress(input); StringConvert.extractEmailAddress(input);
StringConvert.isTextTable('$input\n$input'); StringConvert.isTextTable('$input\n$input');
HtmlUtils.extractPlainText(input); HtmlUtils.extractPlainText(input);
} catch (e) { } catch (_) {
// It's OK if these fail, we're just testing performance // Intentionally ignored - focus is on performance, not correctness
} }
stopwatch.stop(); stopwatch.stop();