Regular Expression without Anchors
CWE-777
The product uses a regular expression to perform neutralization, but the regular expression omits one or more anchors that may allow malicious or malformed data to slip through.
We track 1 vulnerability of this type. 100% are rated high or critical, and the average CVSS score is 7.3.
How this weakness is prevented
- Implementation: Be sure to understand both what will be matched and what will not be matched by a regular expression. Anchoring the ends of the expression will allow the programmer to define an allowlist strictly limited to what is matched by the text in the regular expression. If you are using a package that only matches one line by default, ensure that you can match multi-line inputs if necessary.
Latest Regular Expression without Anchors vulnerabilities
- 7.3 High severity
jupyter_server: Regular Expression without Anchors
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the