Sven Geggus
Au weia ich habe kaum Ahnung von #nodejs und #express und jetzt mögen neuere Versionen meine #regex nicht mehr. #WTF https://github.com/pillarjs/path-to-regexp sagt [0-9] gäbe es nicht mehr.
Ja was denn sonst ihr Deppen?
GitHub - pillarjs/path-to-regexp: Turn a path string such as `/user/:name` into a regular expression

Turn a path string such as `/user/:name` into a regular expression - pillarjs/path-to-regexp

GitHub
Dec 30 at 9:40pmWeb
Show threadSebastian BeltranDec 30
@giggls There were reasons to remove much of the regex support and features, and then gradually work on adding them back, but without the possibility of unintentionally introducing a ReDoS.
Show threadSebastian BeltranDec 30
@giggls https://github.com/pillarjs/path-to-regexp/issues/380
Parameter customization · Issue #380 · pillarjs/path-to-regexp

In versions < 8 it was possible to customize the parameter match using a regex. For example, :param(a|b|c). While this is immensely helpful for end users, it created a security issue if the user ma...

GitHub
Show threadSven GeggusDec 30
@bjohansebas I doubt that [0-9]+$ is dangerous.
Show threadSebastian BeltranDec 30
@giggls it may not be dangerous, but we need to work on adding it in a safe way, and that’s something we know Express 5 is lacking. Pull requests are always welcome.
Show threadSven GeggusDec 30
@bjohansebas Huh? As I already wrote in German. I have almost no idea about this stuff. It just broke that is all I saw.
Show threadOriel Jutty 6d ago
@giggls @bjohansebas Maybe not, but [0-9]+[0-9]+[0-9]+$ may be.