Cluster Caching

[thehabes]

No description provided.

To fix this issue, all user input that is joined/interpolated into a regular expression must be sanitized to escape regex special characters. The best-known solution is to use lodash’s escapeRegExp function, which safely escapes all regex metacharacters in a given string. Thus, before interpolating the values (objIdShort, previousId, and primeId) into the regex, each value must be passed through _.escapeRegExp.

Make the following changes in cache/middleware.js:

• Import lodash (_) at the top of the file. (If other parts of your project already use lodash, you may already have it, but add it if not.)
• In the section where versionIds is constructed, apply _.escapeRegExp to each of the three IDs before joining them.
• No changes to project functionality, just ensures any regex metacharacters in user-controlled input are escaped.

---

To fix the problem, every value that is interpolated into the regular expression must be escaped in a way that prevents it from affecting the regular expression's structure. The best approach is to use a well-tested library function, such as _.escapeRegExp from lodash, to escape any regex special characters in each component ID before constructing the regex pattern.

Specifically, in cache/middleware.js:

• Import lodash's escapeRegExp.
• When creating versionIds, escape each id in the array using _.escapeRegExp, before joining them and inserting them into the regex pattern.

This ensures that no part of user-controlled input can introduce regex metacharacters or modify the meaning of the expression.

---

To fix the log injection risk, any user-supplied value that is written to logs should be sanitized to remove newlines and other characters that can create log injection vulnerabilities. In the affected line (console.log on line 65), the potentially dangerous value is expectedVersion, which is taken directly from an HTTP header. The best and simplest fix is to sanitize expectedVersion to remove any newline sequences before logging.

• Before logging, replace all occurrences of \r and \n in expectedVersion (the user-supplied header value) with empty strings.
• The string interpolation in the log message remains unchanged, except now using the sanitized version.
• This should be done only for the log entry, not for processing/logic elsewhere (for auditability of errors as they occurred).

What to change:

• In file controllers/overwrite.js, on or just before line 65, add a line that creates a sanitized version of expectedVersion by removing \r and \n (using .replace(/\r|\n/g, "")).
• Use this sanitized variable in the log statement on line 65.

No additional imports are needed.

---