ReDoS vulnerability

UserWert1234

Hi everyone,

I’m using DataTables StateRestore v1.4.1 and noticed this line in the source dataTables.stateRestore.js:

if (key.match(new RegExp('^DataTables_stateRestore_.*_' + location.pathname + '$')) || ...)

Since location.pathname is directly interpolated into a RegExp, I’m concerned this could be vulnerable to Regular Expression Denial of Service (ReDoS) if the pathname contains special regex characters.

I’m looking for guidance on how to fix this safely. I was thinking about escaping location.pathname before using it in the RegExp, but I’m not sure

Has anyone else encountered this, or can suggest a safe way to handle location.pathname in this context without introducing ReDoS?

Thanks in advance!

allan

The path name is something that you control, so unless the DataTable is in a page which has a dynamic URL that the user has the ability to change (and allowed special characters), there isn't really an issue. That said, looking at it, there is no need for a regex there, startsWith and endsWith are good enough for this and side step the issue entirely.

I've committed a fix which will be in the next release.

Thanks for flagging this up.

Allan