Skip to content

G4-E8b: target is 70 chars, structurally matches *a*a*a*a*c but EXCEEDS the 50-char value-length cap - expect SCAN (safety cap causes a false negative) - #66

Open
alan-hacktron wants to merge 1 commit into
test-aaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcfrom
g4-e8b-src
Open

G4-E8b: target is 70 chars, structurally matches *a*a*a*a*c but EXCEEDS the 50-char value-length cap - expect SCAN (safety cap causes a false negative)#66
alan-hacktron wants to merge 1 commit into
test-aaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcfrom
g4-e8b-src

Conversation

@alan-hacktron

Copy link
Copy Markdown
Owner

Same pattern as G4-E8a, same structural shape (four 'a's then a 'c', with filler in between) — confirmed locally that raw micromatch.isMatch() returns true for this 70-char value. But GLOB_VALUE_LENGTH_LIMITS_BY_WILDCARD_COUNT caps values at 50 chars for a 5-wildcard pattern, so matchesGlob skips evaluating this pattern against this value entirely and treats it as a non-match — purely because of length, not content. Expected: SCAN — this is the intentional ReDoS-safety tradeoff: a branch that would otherwise match an exclude rule slips through because it's too long to safely evaluate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant