G4-E8b: target is 70 chars, structurally matches *a*a*a*a*c but EXCEEDS the 50-char value-length cap - expect SCAN (safety cap causes a false negative) - #66
Open
alan-hacktron wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same pattern as G4-E8a, same structural shape (four 'a's then a 'c', with filler in between) — confirmed locally that raw micromatch.isMatch() returns true for this 70-char value. But GLOB_VALUE_LENGTH_LIMITS_BY_WILDCARD_COUNT caps values at 50 chars for a 5-wildcard pattern, so matchesGlob skips evaluating this pattern against this value entirely and treats it as a non-match — purely because of length, not content. Expected: SCAN — this is the intentional ReDoS-safety tradeoff: a branch that would otherwise match an exclude rule slips through because it's too long to safely evaluate.