https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41932
--- Comment #55 from David Cook <[email protected]> --- (In reply to Marcel de Rooy from comment #54) > (In reply to David Cook from comment #40) > > Upon review... the code is not very easy to read at all and I think it might > > not validate/sanitize the inputs enough, although I haven't done a practical > > check yet. We want to be careful when it comes to regex inputs. I wish we > > hadn't added regex to other parts of Koha because it's a nightmare to > > secure. > > I removed the regex feature. Altough I think that matching only should not > be a nightmare.. I'm not sure if you saw my message on Mattermost, but I've tried Regular Expression Denial of Service (ReDoS) with Perl using payloads and strategies outlined by folk like OWASP, and I can't get Perl to break. So while there may be a theoretical problem with match inputs... I think in practice it's OK. So if you did want to include the regex I think it would be OK. Sorry for the run around on this one! -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
