Skip to content

fix: escape regex metacharacters in search to prevent ReDoSEscape search regex input#14

Open
AaravKashyap12 wants to merge 1 commit into
Dhanika-Bhat:mainfrom
AaravKashyap12:fix/search-regex-escaping-only
Open

fix: escape regex metacharacters in search to prevent ReDoSEscape search regex input#14
AaravKashyap12 wants to merge 1 commit into
Dhanika-Bhat:mainfrom
AaravKashyap12:fix/search-regex-escaping-only

Conversation

@AaravKashyap12
Copy link
Copy Markdown

Closes #3

What this PR does

Escapes user-supplied search input before using it as a MongoDB $regex in both routes/products.js and routes/stores.js:

> const safeSearch = search.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');

Changes

File Change
server/routes/products.js Escape search input before $regex
server/routes/stores.js Escape search input before $regex

Verification

npm test → 2 passed, 0 failing

Note

This fix escapes regex metacharacters to prevent regex injection and reduce ReDoS risk. Full-text search performance on large datasets would benefit from MongoDB text indexes or a dedicated search service, tracked separately.

@vercel
Copy link
Copy Markdown

vercel Bot commented May 18, 2026

@AaravKashyap12 is attempting to deploy a commit to the dhanika2006-7071's projects Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] : Regex Search Performance Degradation with Leading Wildcard

1 participant