Skip to content

[Java]: CWE-730 Regex injection #351

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
1 task
ghost opened this issue Apr 26, 2021 · 6 comments
Closed
1 task

[Java]: CWE-730 Regex injection #351

ghost opened this issue Apr 26, 2021 · 6 comments
Labels
All For One Submissions to the All for One, One for All bounty

Comments

@ghost
Copy link

ghost commented Apr 26, 2021

Query

Link to pull request with your CodeQL query:

Relevant PR: github/codeql#5704

Report

User controlled regex pattern may lead to Denial of Service.

  • Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing
@ghost ghost added the All For One Submissions to the All for One, One for All bounty label Apr 26, 2021
@ghsecuritylab
Copy link
Collaborator

Your submission is now in status SecLab review.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

@ghsecuritylab
Copy link
Collaborator

Your submission is now in status CodeQL review.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

@ghsecuritylab
Copy link
Collaborator

Your submission is now in status SecLab finalize.

For information, the evaluation workflow is the following:
SecLab review > FP Check > CodeQL review > SecLab finalize > Pay > Closed

@ghsecuritylab
Copy link
Collaborator

Your submission is now in status Pay.

For information, the evaluation workflow is the following:
SecLab review > FP Check > CodeQL review > SecLab finalize > Pay > Closed

@xcorail
Copy link
Contributor

xcorail commented Jun 7, 2021

Created Hackerone report 1219492 for bounty 309995 : [351] [Java]: CWE-730 Regex injection

@xcorail xcorail closed this as completed Jun 7, 2021
@ghsecuritylab
Copy link
Collaborator

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
SecLab review > FP Check > CodeQL review > SecLab finalize > Pay > Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
All For One Submissions to the All for One, One for All bounty
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@xcorail @ghsecuritylab