Skip to content

repl: preventing recursive eval of RegEx predefined properties #2137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

repl: preventing recursive eval of RegEx predefined properties #2137

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions lib/repl.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,12 @@ function REPLServer(prompt,
// just for backwards compat, see github.com/joyent/node/pull/7127
self.rli = this;

const savedRegExMatches = ['', '', '', '', '', '', '', '', '', ''];
const sep = '\u0000\u0000\u0000';
const regExMatcher = new RegExp(`^${sep}(.*)${sep}(.*)${sep}(.*)${sep}(.*)` +
`${sep}(.*)${sep}(.*)${sep}(.*)${sep}(.*)` +
`${sep}(.*)$`);

eval_ = eval_ || defaultEval;

function defaultEval(code, context, file, cb) {
Expand Down Expand Up @@ -148,6 +154,10 @@ function REPLServer(prompt,
break;
}

// This will set the values from `savedRegExMatches` to corresponding
// predefined RegExp properties `RegExp.$1`, `RegExp.$2` ... `RegExp.$9`
regExMatcher.test(savedRegExMatches.join(sep));

if (!err) {
try {
if (self.useGlobal) {
Expand All @@ -166,6 +176,12 @@ function REPLServer(prompt,
}
}

// After executing the current expression, store the values of RegExp
// predefined properties back in `savedRegExMatches`
for (let idx = 1; idx < savedRegExMatches.length; idx += 1) {
savedRegExMatches[idx] = RegExp[`$${idx}`];
}

cb(err, result);
}

Expand Down
10 changes: 10 additions & 0 deletions test/parallel/test-repl.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,6 +232,16 @@ function error_test() {
{ client: client_unix, send: '\'the\\\n\\\nfourtheye\'\n',
expect: prompt_multiline + prompt_multiline +
'\'thefourtheye\'\n' + prompt_unix },
// Regression test for https://github.com/nodejs/io.js/issues/597
{ client: client_unix,
send: '/(.)(.)(.)(.)(.)(.)(.)(.)(.)/.test(\'123456789\')\n',
expect: `true\n${prompt_unix}` },
// the following test's result depends on the RegEx's match from the above
{ client: client_unix,
send: 'RegExp.$1\nRegExp.$2\nRegExp.$3\nRegExp.$4\nRegExp.$5\n' +
'RegExp.$6\nRegExp.$7\nRegExp.$8\nRegExp.$9\n',
expect: ['\'1\'\n', '\'2\'\n', '\'3\'\n', '\'4\'\n', '\'5\'\n', '\'6\'\n',
'\'7\'\n', '\'8\'\n', '\'9\'\n'].join(`${prompt_unix}`) },
]);
}

Expand Down