Comments (3)
Finesse
commented on September 23, 2024
Hello @diegortegam, thank you for reporting this.
Why do you call it vulnerability? This regular expression is used only in tests and doesn't deal with user input. The regular expression performance is acceptable with '(m\t' + '\t'.repeat(5477) which is far beyond what the regular expression actually deals with. As you can see, the test performance is not something to worry about.
from fingerprintjs.
diegortegam
commented on September 23, 2024
Yeah, I just want to make sure but, I though it wouldn't be exploitable because the code is used in the unit test. Right?
I mean, it wouldn't be possible for someone to inject a string in the CSS media match properties and make the regular expression run for so long the server crashes.
from fingerprintjs.
Finesse
commented on September 23, 2024
I though it wouldn't be exploitable because the code is used in the unit test. Right?
Right, only during tests and only with a defined input.
make the regular expression run for so long the server crashes
FingerprintJS can't run on server, it's for browser only.
from fingerprintjs.
Related Issues (20)
- Can you fingerprint out whose device it is regardless of browser in a mobile environment?
- Unstable 'canvas' entropy source when runs in a cross-origin iframe HOT 10
- FingerPrint VisitorId In Chrome And Edge IS SAME HOT 1
- Getting net::ERR_BLOCKED_BY_CLIENT with Adblocker extension HOT 1
- How to get the city, ip and other information in fingerprntjs v4, how to write the code HOT 1
- I'm not sure if FingerprintJS V4 excludes the component according to the code I wrote. HOT 2
- The identifier is the same on two different devices HOT 1
- iOS: Pro Version Fingerprint changes after device reset HOT 5
- tokenpocket webview crash HOT 1
- 有时候为什么会报这个错? HOT 2
- Empty Notification 4.2.0 HOT 1
- same visitor id on two different device in iphone 13 HOT 3
- GDPR compliance: Provide instructions on how to clear stored state of the pro version HOT 3
- Getting Uncaught (in promise) TypeError error in firefox HOT 3
- CORS errros when accessing openfpcdn.io from Firefox HOT 1
- An error will be reported in IE8/9/10 because they do not have navigator.vendor HOT 1
- Attested Fingerprint IDs: Ensuring Authenticity HOT 1
- `yarn build` doesn't work on Windows HOT 5
- Remove 'npm-monitoring' analytics. HOT 2
- deviceid changed in mac os HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fingerprintjs.