spamscanner/url-regex-safeRegular expression matching for URL's. Maintained, safe, and browser-friendly version of url-regex. Resolves CVE-2020-7661 for Node.js servers.
Regular expression matching for URL's. Maintained, safe, and browser-friendly version of [url-regex][]. Resolves [CVE-2020-7661][cve] for Node.js servers. Works in Node v14+ and browsers. Maintained for [Spam Scanner][spam-scanner] and [Forward Email][forward-email].
After discovering [CVE-2020-7661][cve] and disclosing it publicly (through my work on [Spam Scanner][spam-scanner] and [Forward Email][forward-email]) – I used an implementation of [url-regex][] with some extra glue on top to filter out bad URL matches.
However after using it on [Forward Email][forward-email] in production (which processes hundreds of thousands of emails per week), I found and documented several more core issues with [url-regex][].
Realizing that [url-regex][] is no longer actively maintained, has 9 open pull requests as of this writing, and also lacked browser support – I decided to write this package for everyone and merge all the open pull requests.
This package should hopefully more closely resemble real-world intended usage of a URL regular expression, and also allowing the user to configure it as they wish. Please check out [Forward Email][forward-email] if this package helped you, and explore our source code on GitHub which shows how we use this package.
NOTE: The default behavior of this package will attempt to load re2 (it is an optional peer dependency used to prevent regular expression denial of service attacks and more). If you wish to use this behavior, you must have re2 installed via npm install re2 – otherwise it will fallback to using normal RegExp instances. As of v4.0.0 we added an option if you wish to force this package to not even attempt to load re2 (e.g. it's in your node_modules but you don't want to use it) – simply pass re2: false as an option.
[npm][]:
npm install url-regex-safe
We've resolved [CVE-2020-7661][cve] by including [RE2][] for Node.js usage. You will not have to manually wrap your URL regular expressions with new RE2(urlRegex()) anymore through url-regex-safe (we do it automatically for you).
const urlRegexSafe = require('url-regex-safe');
const str = 'some long string with url.com in it';
const matches = str.match(urlRegexSafe());
for (const match of matches) {
console.log('match', match);
}
console.log(urlRegexSafe({ exact: true }).test('github.com'));
Since [RE2][] is not made for the browser, it will not be used, and therefore [CVE-2020-7661][cve] is still an issue on the client-side. However it is not severe since the most it would do is crash the browser tab (as on the Node.js side it would have crashed the entire process and thrown an out of memory exception).
This is the solution for you if you're just using <script> tags everywhere!
<script src="https://unpkg.com/url-regex-safe"></script>
<script type="text/javascript">
(function() {
var str = 'some long string with url.com in it';
var matches = str.match(urlRegexSafe());
for (var i=0; i<matches.length; i++) {
console.log('match', matches[i]);
}
console.log(urlRegexSafe({ exact: true }).test('github.com'));
})();
</script>
Assuming you are using [browserify][], [webpack][], [rollup][], or another bundler, you can simply follow Node usage above.
To use this package with TypeScript, you can install the @types/url-regex-safe package for type definitions.
npm install --save-dev @types/url-regex-safe