Merge pull request #45 from pagopa/IOPID-1643-redos-signature-input-v…

…ulnerability-fix [#IOPID-1643] Fix ReDOS vulnerability on Lollipop SignatureInput param
pagopa-archive · Mar 7, 2024 · 08e0f2e · 08e0f2e
2 parents b5f83f5 + ceda9c0
commit 08e0f2e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/openapi/lollipop_first_consumer.yaml b/openapi/lollipop_first_consumer.yaml
@@ -178,7 +178,7 @@ components:
 
     LollipopSignatureInput:
       type: string
-      pattern: "^(((sig[0-9]+)=[^,]*?)(, ?)?)+$"
+      pattern: "^(?:sig\\d+=[^,]*)(?:,\\s*(?:sig\\d+=[^,]*))*$"
     LollipopSignature:
       type: string
       pattern: "^((sig[0-9]+)=:[A-Za-z0-9+/=]*:(, ?)?)+$"