취약점

Summary

The HTMLInputElement.checkValidity() method constructed a RegExp directly from the user-controlled pattern property without any sanitization or timeout protection. This allowed an attacker to inject a regex with catastrophic backtracking, freezing the event loop.

Fix

Fixed in commit https://github.com/asymmetric-effort/NogginLessDom/commit/25a3cbac665fae5663f8b71c073b80c3152dbe7b on main. Added:

• Pattern length limit (1024 characters)
• Nested quantifier detection (hasNestedQuantifiers) that rejects patterns like (a+)+ before constructing the regex
• Patterns exceeding limits are treated as non-matching (safe default)