Skip to content

Security: Improve environment variable expansion regex #30263

@nandordudas

Description

@nandordudas

Environment

No environment needed.

Reproduction

  1. Check /\{\{(.*?)\}\}/g at /packages/kit/src/runtime-config.ts.
  2. Go to Devina, select ReDoS checker and paste current regular expression.
Devina screenshot

Image

Note:
Same result on ReDoS Detector.

Describe the bug

Just consider to replace current value, example /\{\{([^{}]*)\}\}/g - is safe on Devina but not safe on ReDoS Detector.

Additional context

  • Low priority - current usage context is safe
  • No direct user input exposure
  • Only runs during config initialization

Logs

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions