[LEGIT] Fix - js/polynomial-redos

[liorn-test-app]

🔍 The problem

Polynomial regular expression used on uncontrolled data
See issue in Legit

🔒 Fix Details

Fixed a Regular Expression Denial of Service (ReDoS) vulnerability in the bank routing number validation. The code previously tested user-supplied input directly against a regex pattern without length limits, allowing attackers to submit extremely long strings that would cause catastrophic backtracking and CPU exhaustion.

The fix adds input validation before the regex test: it checks that bankRouting is a string and enforces a maximum length of 20 characters (sufficient for legitimate routing numbers). This prevents malicious input from triggering exponential-time regex evaluation while preserving the existing validation logic for properly-sized inputs.

--- a/app/routes/profile.js
+++ b/app/routes/profile.js
@@ -41,6 +41,19 @@
         // The Fix: Instead of using greedy quantifiers the same regex will work if we omit the second quantifier +
         // const regexPattern = /([0-9]+)\#/;
         const regexPattern = /[0-9]+\#/;
+        // Prevent ReDoS by limiting input length before regex evaluation
+        if (typeof bankRouting !== 'string' || bankRouting.length > 20) {
+            return res.render("profile", {
+                updateError: "Bank Routing number exceeds maximum allowed length",
+                firstName,
+                lastName,
+                ssn,
+                dob,
+                address,
+                bankAcc,
+                bankRouting: ''
+            });
+        }
         // Allow only numbers with a suffix of the letter #, for example: 'XXXXXX#'
         const testComplyWithRequirements = regexPattern.test(bankRouting);
         // if the regex test fails we do not allow saving

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud