diff --git a/package.json b/package.json index 5612171..2400f23 100644 --- a/package.json +++ b/package.json @@ -120,6 +120,7 @@ "jshint": "~2.12.0", "mocha": "~8.2.0", "requirejs": "^2.3.2", + "safe-regex": "^2.1.1", "uglify-js": "~3.12.0", "verup": "^1.3.x" }, diff --git a/test/test.js b/test/test.js index b0e699c..5b55ade 100644 --- a/test/test.js +++ b/test/test.js @@ -1,3 +1,5 @@ +var fs = require('fs'); +var safe = require('safe-regex'); var assert = require('assert'); var requirejs = require('requirejs'); var UAParser = require('./../src/ua-parser'); @@ -121,4 +123,29 @@ describe('Using Require.js', function () { done(); }); }); -}); \ No newline at end of file +}); + +describe('Testing regexes', function () { + + var regexes; + + // todo: use AST-based instead of grep + before('Read main js file', function (done) { + fs.readFile('src/ua-parser.js', 'utf8', function (err, data) { + regexes = data.match(/(\/.+\/[ig]+)(?=[,\s\n])/g); + done(); + }); + }); + + describe('Begin testing', function () { + it('all regexes in main file', function () { + regexes.forEach(function (regex) { + describe('Test against `safe-regex` : ' + regex, function () { + it('should be safe from potentially vulnerable regex', function () { + assert.strictEqual(safe(regex), true); + }); + }); + }); + }); + }); +}) \ No newline at end of file