[LEGIT] Fix - js/polynomial-redos

[liorn-test-app]

🔍 The problem

Polynomial regular expression used on uncontrolled data
See issue in Legit

🔒 Fix Details

Fixed a Regular Expression Denial of Service (ReDoS) vulnerability in email validation. The original code applied a potentially complex regular expression (EMAIL_RE) to user-controlled input without any length limit, which could allow an attacker to submit a specially crafted email string that causes catastrophic backtracking and CPU exhaustion.

The fix adds an explicit length check (254 characters, per RFC 5321) before the regex validation. This bounds the maximum time the regex engine can run, preventing denial of service attacks even if the regex pattern contains nested quantifiers or other backtracking-prone constructs.

Note: The plan also recommended replacing EMAIL_RE with a simpler pattern like /^[^\s@]+@[^\s@]+\.[^\s@]+$/, but since the regex definition is not visible in the provided code window, that change must be applied separately where EMAIL_RE is defined.

--- a/app/routes/session.js
+++ b/app/routes/session.js
@@ -163,6 +163,10 @@
             return false;
         }
         if (email !== "") {
+            if (email.length > 254) {
+                errors.emailError = "Invalid email address";
+                return false;
+            }
             if (!EMAIL_RE.test(email)) {
                 errors.emailError = "Invalid email address";
                 return false;
@@ -193,7 +197,6 @@
                 }
 
                 userDAO.addUser(userName, firstName, lastName, password, email, (err, user) => {
-
                     if (err) return next(err);
 
                     //prepare data for the user

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud