Skip to content

Commit 949d6e2

Browse files
Add test for the vuln I just fixed (#650)
1 parent 15a1585 commit 949d6e2

File tree

1 file changed

+40
-0
lines changed

1 file changed

+40
-0
lines changed

test/patch/parse.js

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -553,6 +553,46 @@ diff -r 9117c6561b0b -r 273ce12ad8f1 README
553553
]);
554554
});
555555

556+
it('should treat non-ASCII line break characters \\u2028 and \\u2029 like ordinary characters', () => {
557+
// Regression test for nasty denial-of-service vulnerability fixed by
558+
// https://github.com/kpdecker/jsdiff/pull/649
559+
const patch = 'Index: t\u2028e\u2028s\u2028t\n' +
560+
'--- f\u2028o\u2028o\t2023-12-20\u202816:11:20.908225554\u2028+0000\u2028\n' +
561+
'+++ b\u2028a\u2028r\t2023-12-20\u202816:11:34.391473579\u2028+0000\u2028\n' +
562+
'@@ -1,4 +1,4 @@\n' +
563+
' foo\n' +
564+
'-bar\u2028bar\n' +
565+
'+barry\u2028barry\n' +
566+
' baz\n' +
567+
' qux\n' +
568+
'\\ No newline at end of file\n';
569+
expect(parsePatch(patch)).to.eql([
570+
{
571+
oldFileName: 'f\u2028o\u2028o',
572+
oldHeader: '2023-12-20\u202816:11:20.908225554\u2028+0000',
573+
newFileName: 'b\u2028a\u2028r',
574+
newHeader: '2023-12-20\u202816:11:34.391473579\u2028+0000',
575+
index: 't\u2028e\u2028s\u2028t',
576+
hunks: [
577+
{
578+
oldStart: 1,
579+
oldLines: 4,
580+
newStart: 1,
581+
newLines: 4,
582+
lines: [
583+
' foo',
584+
'-bar\u2028bar',
585+
'+barry\u2028barry',
586+
' baz',
587+
' qux',
588+
'\\ No newline at end of file'
589+
]
590+
}
591+
]
592+
}
593+
]);
594+
});
595+
556596
it('should tolerate patches with extra trailing newlines after hunks', () => {
557597
// Regression test for https://github.com/kpdecker/jsdiff/issues/524
558598
// Not only are these considered valid by GNU patch, but jsdiff's own formatPatch method

0 commit comments

Comments
 (0)