Merge pull request #528 from ncats/synkfix

snyk regexp ddos fix
ncats · Jul 24, 2024 · 0f4eea7 · 0f4eea7
2 parents e7adf9f + 8a37176
commit 0f4eea7
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/app/core/substance-ssg2/substance-ssg2-form.service.ts b/src/app/core/substance-ssg2/substance-ssg2-form.service.ts
@@ -1424,7 +1424,10 @@ export class SubstanceSsg2FormService implements OnDestroy {
       substanceString = JSON.stringify(substanceCopy);
 
       deletedUuids.forEach(uuid => {
-        substanceString = substanceString.replace(new RegExp(`"${uuid}"`, 'g'), '');
+        const pattern = /^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$/;
+        if(pattern.test(uuid)) {
+          substanceString = substanceString.replace(new RegExp(`"${uuid}"`, 'g'), '');
+        }
       });
       substanceString = substanceString.replace(/,[,]+/g, ',');
       substanceString = substanceString.replace(/\[,/g, '[');