[LEGIT] Fix - js/polynomial-redos

[liorn-test-app]

🔍 The problem

Polynomial regular expression used on uncontrolled data
See issue in Legit

🔒 Fix Details

Fixed a Regular Expression Denial of Service (ReDoS) vulnerability in email validation. The original code used EMAIL_RE.test(email) which could contain a regex pattern with nested quantifiers that cause catastrophic backtracking when processing malicious input. Replaced the vulnerable regex test with validator.isEmail(email) from the validator.js library, which uses safe, linear-time validation patterns that are specifically designed to avoid ReDoS attacks. This change requires the validator package to be imported at the top of the file and added as a dependency if not already present.

--- a/app/routes/session.js
+++ b/app/routes/session.js
@@ -163,7 +163,7 @@
             return false;
         }
         if (email !== "") {
-            if (!EMAIL_RE.test(email)) {
+            if (!validator.isEmail(email)) {
                 errors.emailError = "Invalid email address";
                 return false;
             }
@@ -193,7 +193,6 @@
                 }
 
                 userDAO.addUser(userName, firstName, lastName, password, email, (err, user) => {
-
                     if (err) return next(err);
 
                     //prepare data for the user

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE