SecOps #1503
open[Sécurité] Vulnérabilité de code : src/lib/admin/__tests__/dailyDigestSchedule.test.ts:38 (javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp)
0%
Description
**Sévérité** : MEDIUM
**Source** : Semgrep
`vuln-medium`
**Emplacement** : src/lib/admin/__tests__/dailyDigestSchedule.test.ts:38
**Règle** : javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
RegExp() called with a `scheduleKey` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
### Extrait de code
```
requires login
```
### Lien CVE
https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
CD Updated by Client Dashboard 11 days ago
Vulnérabilité `src/lib/admin/__tests__/dailyDigestSchedule.test.ts:38_javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).