[LEGIT] Fix - js/polynomial-redos

[liorn-test-app]

🔍 The problem

Polynomial regular expression used on uncontrolled data
See issue in Legit

🔒 Fix Details

Fixed a Regular Expression Denial of Service (ReDoS) vulnerability in email validation. The original code used EMAIL_RE.test(email) to validate user-supplied email addresses, which could contain a regex pattern with catastrophic backtracking. An attacker could craft a malicious email string that causes exponential evaluation time, blocking the Node.js event loop and causing a denial of service.

The fix replaces the vulnerable regex test with validator.isEmail(email) from the well-tested validator.js library. This library implements safe email validation without backtracking patterns and is specifically designed to handle adversarial input.

Note: This fix assumes the validator package is available. You will need to add const validator = require('validator'); at the top of the file and ensure validator is listed in package.json dependencies.

--- a/app/routes/session.js
+++ b/app/routes/session.js
@@ -163,7 +163,7 @@
             return false;
         }
         if (email !== "") {
-            if (!EMAIL_RE.test(email)) {
+            if (!validator.isEmail(email)) {
                 errors.emailError = "Invalid email address";
                 return false;
             }
@@ -193,7 +193,6 @@
                 }
 
                 userDAO.addUser(userName, firstName, lastName, password, email, (err, user) => {
-
                     if (err) return next(err);
 
                     //prepare data for the user

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!