wkadmin/the-tip-top-frontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve SonarQube security vulnerabilities

Browse Source 
- Fix ReDoS vulnerability in email regex with length limit and safer pattern
- Replace Math.random() with crypto.getRandomValues() for secure ID generation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
soufiane 2025-11-27 12:54:22 +01:00
parent ae03eb7eed
commit 8bd2f95f25
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
utils/helpers.ts
View File

@ -133,7 +133,10 @@ export const capitalize = (str: string): string => {
// Validation Helpers // Validation Helpers
export const isValidEmail = (email: string): boolean => { export const isValidEmail = (email: string): boolean => {
const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; // Limit input length to prevent ReDoS attacks
if (!email || email.length > 254) return false;
// Simple and safe email regex (non-backtracking)
const emailRegex = /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
return emailRegex.test(email); return emailRegex.test(email);
}; };
@ -157,9 +160,15 @@ export const deepClone = <T>(obj: T): T => {
return JSON.parse(JSON.stringify(obj)); return JSON.parse(JSON.stringify(obj));
}; };
// Generate Random ID // Generate Random ID (cryptographically secure)
export const generateId = (): string => { export const generateId = (): string => {
return Math.random().toString(36).substring(2) + Date.now().toString(36); if (typeof window !== 'undefined' && window.crypto) {
const array = new Uint32Array(2);
window.crypto.getRandomValues(array);
return array[0].toString(36) + array[1].toString(36) + Date.now().toString(36);
}
// Fallback for SSR (non-sensitive context)
return Date.now().toString(36) + Math.random().toString(36).substring(2);
}; };
// Debounce Function // Debounce Function