Skip to content

Commit

Permalink
fix: simplify regex for strict mode, add tests
Browse files Browse the repository at this point in the history
  • Loading branch information
nlf committed Jan 19, 2021
1 parent 41b764f commit 76e2233
Show file tree
Hide file tree
Showing 2 changed files with 31 additions and 2 deletions.
5 changes: 3 additions & 2 deletions index.js
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ const SPEC_ALGORITHMS = ['sha256', 'sha384', 'sha512']
// rather than [a-z0-9].
const BASE64_REGEX = /^[a-z0-9+/]+(?:=?=?)$/i
const SRI_REGEX = /^([a-z0-9]+)-([^?]+)([?\S*]*)$/
const STRICT_SRI_REGEX = /^([a-z0-9]+)-([A-Za-z0-9+/=]{44,88})(\?[\x21-\x7E]*)*$/
const STRICT_SRI_REGEX = /^([a-z0-9]+)-([A-Za-z0-9+/=]{44,88})(\?[\x21-\x7E]*)?$/
const VCHAR_REGEX = /^[\x21-\x7E]+$/

const defaultOpts = {
Expand All @@ -24,7 +24,8 @@ const defaultOpts = {

const ssriOpts = (opts = {}) => ({ ...defaultOpts, ...opts })

const getOptString = options => !options || !options.length ? ''
const getOptString = options => !options || !options.length
? ''
: `?${options.join('?')}`

const _onEnd = Symbol('_onEnd')
Expand Down
28 changes: 28 additions & 0 deletions test/parse.js
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,34 @@ test('parses single-entry integrity string', t => {
t.done()
})

test('parses options from integrity string', t => {
const sha = hash(TEST_DATA, 'sha512')
const integrity = `sha512-${sha}?one?two?three`
t.deepEqual(ssri.parse(integrity), {
sha512: [{
source: integrity,
digest: sha,
algorithm: 'sha512',
options: ['one', 'two', 'three']
}]
}, 'single entry parsed into full Integrity instance')
t.done()
})

test('parses options from integrity string in strict mode', t => {
const sha = hash(TEST_DATA, 'sha512')
const integrity = `sha512-${sha}?one?two?three`
t.deepEqual(ssri.parse(integrity, { strict: true }), {
sha512: [{
source: integrity,
digest: sha,
algorithm: 'sha512',
options: ['one', 'two', 'three']
}]
}, 'single entry parsed into full Integrity instance')
t.done()
})

test('can parse single-entry string directly into Hash', t => {
const sha = hash(TEST_DATA, 'sha512')
const integrity = `sha512-${sha}`
Expand Down

2 comments on commit 76e2233

@SymbioticKilla
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nlf Is it a fix for CVE-2021-27290? Can it be ported and released as 6.0.2 Version? Thanks!

@AndrewGibson27
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@SymbioticKilla @nlf

Here's a branch that ports this fix into v6. Only trouble is I'm not sure how to open a PR for it because (so far as I can tell) there's no branch in this project for v6.

Please sign in to comment.