[VULNERABILITY] Parsing a long String will result in 100% CPU usage and `String.test` will never finish

IMPORTANT UPDATE (8/15/20)

Per my comment below, I have released my own package, url-regex-safe, which resolves this issue, and all (solvable) existing issues and pull requests here in this GitHub repository. The new package has 100% test coverage and is available at https://github.com/niftylettuce/url-regex-safe. It has more sensible defaults as well.

---

Example:

> require('url-regex')({ strict: false }).test('018137.113.215.4074.138.129.172220.179.206.94180.213.144.175250.45.147.1364868726sgdm6nohQ')

The only way to exit out is to SIGINT.

[niftylettuce]

This issue is fixed in my maintained and modern version of this package at https://github.com/niftylettuce/url-regex-safe. You should be able to switch from url-regex to url-regex-safe now. See the updated list of options as I added some new ones, and changed a few defaults to more sensible ones (since not everyone is parsing Markdown for instance).

[ggkitsas]

Hi, I am communicating on behalf of Snyk’s Security Team. We have verified this vulnerability and reached out to try and discuss this issue further with the maintainers several times. As of now we have yet to get a response, and due to this vulnerability already being exposed publicly, we feel the responsible thing to do is to move to official disclosure.

We have internally assigned a CVE to this vulnerability and will be looking to publish it in our public database in the next 24 hours - if any of the maintainers wish to reach out to us and discuss or wish for us to wait - please do reach out either here or to our disclosure email [e-mail], as we would be very happy to discuss with the maintainer team before publishing.

George, Snyk Security Team