fix(clerk-js): Incomplete string escaping or encoding within password complexity#5786
fix(clerk-js): Incomplete string escaping or encoding within password complexity#5786alexcarpenter wants to merge 2 commits intomainfrom
Conversation
…ng or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
🦋 Changeset detectedLatest commit: 50476de The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
alexcarpenter
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // Avoid a nested group by escaping the `[]` characters | ||
| let escaped = config.allowed_special_characters.replace('[', '\\['); | ||
| escaped = escaped.replace(']', '\\]'); | ||
| let escaped = config.allowed_special_characters.replace(/\[/g, '\\['); |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the issue, we need to ensure that backslashes in the allowed_special_characters string are properly escaped before constructing the regular expression. This can be achieved by adding a replace call to escape backslashes (\) before escaping square brackets ([ and ]). The updated code will replace each backslash with a double backslash (\\), ensuring that the resulting regex is valid and behaves as intended.
The changes will be made in the createTestComplexityCases function, specifically in the block where allowed_special_characters is processed (lines 15–18). No additional imports or dependencies are required.
| @@ -14,4 +14,5 @@ | ||
| if (config.allowed_special_characters) { | ||
| // Avoid a nested group by escaping the `[]` characters | ||
| let escaped = config.allowed_special_characters.replace(/\[/g, '\\['); | ||
| // Avoid a nested group by escaping backslashes and the `[]` characters | ||
| let escaped = config.allowed_special_characters.replace(/\\/g, '\\\\'); | ||
| escaped = escaped.replace(/\[/g, '\\['); | ||
| escaped = escaped.replace(/\]/g, '\\]'); |
| let escaped = config.allowed_special_characters.replace('[', '\\['); | ||
| escaped = escaped.replace(']', '\\]'); | ||
| let escaped = config.allowed_special_characters.replace(/\[/g, '\\['); | ||
| escaped = escaped.replace(/\]/g, '\\]'); |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the issue, we need to ensure that backslashes in the allowed_special_characters string are properly escaped before constructing the regular expression. This can be achieved by adding an additional replace call to escape backslashes (\) before escaping square brackets ([ and ]). The g flag should be used in the regular expression to ensure all occurrences are replaced.
The updated code will:
- First escape all backslashes by replacing each
\with\\. - Then escape square brackets (
[and]) as before.
This ensures that the resulting string is safe to use in a regular expression.
| @@ -15,3 +15,4 @@ | ||
| // Avoid a nested group by escaping the `[]` characters | ||
| let escaped = config.allowed_special_characters.replace(/\[/g, '\\['); | ||
| let escaped = config.allowed_special_characters.replace(/\\/g, '\\\\'); | ||
| escaped = escaped.replace(/\[/g, '\\['); | ||
| escaped = escaped.replace(/\]/g, '\\]'); |
2 participants
Potential fix for https://github.com/clerk/javascript/security/code-scanning/6
To fix the issue, we need to ensure that all occurrences of
]in theallowed_special_charactersstring are escaped. This can be achieved by using a regular expression with the global (g) flag in thereplacemethod. Similarly, the same approach should be applied to the[character for consistency and correctness.The updated code will replace:
with:
Additionally, the replacement for
[should also use a regular expression with thegflag:This ensures that all occurrences of both
[and]are escaped.Suggested fixes powered by Copilot Autofix. Review carefully before merging.