Vulnerable Regular Expression

The following regular expression used in the mime lookup is vulnerable to ReDoS:

/.*[\.\/\\]/

The slowdown is moderately low: for 50.000 characters around 2 seconds matching time. However, I would still suggest one of the following:

• remove the regex,
• anchor the regex,
• limit the number of characters that can be matched by the repetition,
• limit the input size.

If needed, I can provide an actual example showing the slowdown.

[broofa]

npm published in v1.4.1 and 2.0.3

[broofa]

I believe I’m able to repro the issue with the code below. Looks like complexity is ~O(N^2).

var RE = /.*[\.\/\\]/;

function test(len) {
  const str = new Array(len).join().replace(/,/g, ' ');

  const start = process.hrtime()
  const res = str.replace(RE, '');
  console.log('N chars:', len, 'Time:', process.hrtime(start));
}

test(1000);
test(2000);
test(5000);
test(10000);
test(20000);
test(50000);
test(100000);
test(200000);
test(500000);

Yields the following output

N chars: 1000 Time: [ 0, 16273206 ]
N chars: 2000 Time: [ 0, 3165858 ]
N chars: 5000 Time: [ 0, 19505864 ]
N chars: 10000 Time: [ 0, 86073894 ]
N chars: 20000 Time: [ 0, 325145464 ]
N chars: 50000 Time: [ 2, 48747126 ]
N chars: 100000 Time: [ 8, 251471106 ]
N chars: 200000 Time: [ 33, 30366008 ]
N chars: 500000 Time: [ 211, 463680672 ]