fix(unanchored_regex): flag any unanchored location regex, not just file extensions#65
Merged
Merged
Conversation
…ile extensions needs_tail_anchor() only fired when the regex source literally ended with an escaped file extension (\.php style), so plain unanchored patterns like 'location ~ /v1/' — the doc's own bad example — and half-anchored alternations like '^/foo|/bar' were never reported. Replace it with needs_anchor(): walk the parsed regex tree and require every top-level alternative to be pinned at the start (^ / \A) or the end ($ / \Z). Groups, nested branches, and min>=1 repeats are traversed; PCRE's \z (unknown to the vendored parser) is recognized on the source. Severity stays LOW.
…d leading assertions; move helpers up - Normalize unescaped \z to \Z before parsing instead of only honoring a trailing \z on the raw source, so '/x|/y\z' no longer hides the unanchored first alternative. - Unwrap a group spanning the whole pattern in _is_anchored so '(^a|b$)' is accepted like its unwrapped equivalent. - Skip zero-width lookarounds when probing the pattern edges so '(?!/admin)^/v1' counts as anchored (and 'foo$(?!bar)' too). - Move the anchor-walk helpers next to the file's other module-level helpers instead of trailing the Regexp class.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
needs_tail_anchor() only fired when the regex source literally ended with an escaped file extension (.php style), so plain unanchored patterns like 'location ~ /v1/' — the doc's own bad example — and half-anchored alternations like '^/foo|/bar' were never reported.
Replace it with needs_anchor(): walk the parsed regex tree and require every top-level alternative to be pinned at the start (^ / \A) or the end ($ / \Z). Groups, nested branches, and min>=1 repeats are traversed; PCRE's \z (unknown to the vendored parser) is recognized on the source. Severity stays LOW.