@arcis/node 1.6.1 → 1.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +2 -1
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +2 -1
- package/dist/index.mjs.map +1 -1
- package/dist/middleware/index.js +2 -1
- package/dist/middleware/index.js.map +1 -1
- package/dist/middleware/index.mjs +2 -1
- package/dist/middleware/index.mjs.map +1 -1
- package/dist/nestjs/index.js +2 -1
- package/dist/nestjs/index.js.map +1 -1
- package/dist/nestjs/index.mjs +2 -1
- package/dist/nestjs/index.mjs.map +1 -1
- package/dist/sanitizers/index.js +2 -1
- package/dist/sanitizers/index.js.map +1 -1
- package/dist/sanitizers/index.mjs +2 -1
- package/dist/sanitizers/index.mjs.map +1 -1
- package/dist/sanitizers/ldap.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -614,6 +614,7 @@ var LDAP_FILTER_CHARS = /[*()\\\x00]/g;
|
|
|
614
614
|
var LDAP_DN_CHARS = /[,+<>;"=\/\\\x00*()\x00]/g;
|
|
615
615
|
var LDAP_DETECT_PATTERN = /[*()\\\x00]/;
|
|
616
616
|
var LDAP_INJECTION_PATTERN = /\)\s*\(|\*\s*\)\s*\(/;
|
|
617
|
+
var LDAP_NOT_BYPASS_PATTERN = /\)\s*\(\s*!|&\s*\(\s*!|\|\s*\(\s*!/;
|
|
617
618
|
var escapeChar = (char) => "\\" + char.charCodeAt(0).toString(16).padStart(2, "0");
|
|
618
619
|
function sanitizeLdapFilter(input) {
|
|
619
620
|
if (typeof input !== "string") return String(input);
|
|
@@ -625,7 +626,7 @@ function sanitizeLdapDn(input) {
|
|
|
625
626
|
}
|
|
626
627
|
function detectLdapInjection(input) {
|
|
627
628
|
if (typeof input !== "string") return false;
|
|
628
|
-
return LDAP_DETECT_PATTERN.test(input) || LDAP_INJECTION_PATTERN.test(input);
|
|
629
|
+
return LDAP_DETECT_PATTERN.test(input) || LDAP_INJECTION_PATTERN.test(input) || LDAP_NOT_BYPASS_PATTERN.test(input);
|
|
629
630
|
}
|
|
630
631
|
|
|
631
632
|
// src/sanitizers/xpath.ts
|