redos
Safeguard articles tagged "redos" — guides, analysis, and best practices for software supply chain and application security.
53 articles
Validating URLs Safely in Python with the validators Library
The Python validators library's url validator is a quick way to check URLs, but older regex-based versions carried a ReDoS risk. Here's how to use it safely.
Ajv npm: A Security Review and Safe Usage Guide
The ajv npm package is the most widely used JSON Schema validator in the Node ecosystem. Here is what you need to know about its security history and safe configuration.
Is the npm xlsx Package Safe? A Security Review
A security review of the npm xlsx (SheetJS) package: its prototype pollution and ReDoS CVEs, the npm-versus-CDN patch gap, and how to install it safely.
node-html-parser: How to Parse HTML Safely in Node.js
node-html-parser is a fast, dependency-light HTML parser for Node.js. Here is how to use it without opening the door to injection or denial-of-service bugs.
papaparse npm: Security Review and Best Practices
PapaParse is the go-to CSV parser for JavaScript, but older versions carry a ReDoS flaw. Here is a security review and how to use it safely on untrusted files.
CVE-2022-25844: The AngularJS ReDoS Bug and How to Fix It
CVE-2022-25844 is a regular-expression denial-of-service flaw in AngularJS. Here is what it affects, why there is no upstream patch, and how to remediate it.
Is the Cheerio npm Package Safe? A Security Review
A practitioner's look at the cheerio npm package: what it does, where its real security risk lives, and how to use it safely in production scrapers and parsers.
jQuery Validation: A Security Guide to XSS and ReDoS Risks
The jQuery Validation plugin is convenient, but client-side validation is not a security control. Here is where jquery validation has been vulnerable and how to use it safely.
Mobile Number Validation in JavaScript: A Security-Aware Guide
Mobile number validation in JavaScript is easy to get wrong with a naive regex. Here is how to validate phone numbers correctly, safely, and without ReDoS.
marked on npm: Security Review and Safe Usage
marked is a fast Markdown parser, but it does not sanitize output and older versions carried a ReDoS bug. Here is how to use marked npm without opening an XSS hole.
Is the npm Luxon Package Safe to Use? A Security Review
The npm Luxon package is actively maintained and safe for current use, with one notable historical ReDoS advisory to be aware of. Here is the security picture.
Lodash 4.17.21: The Security History Behind the Version Bump
Lodash 4.17.21 closed a ReDoS path in its number-parsing helpers and a command-injection risk in its templating function — here's the security history that led up to it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.