·
2 commits
to release/2.0.x
since this release
Fixed
- Regex vulnerability detection now trims analyzed patterns to 500 characters and evaluates them through bounded helper regexes to avoid the analyzer triggering ReDoS.
- Redis namespace sanitization bounds the namespace prior to regex processing and swaps in precompiled
SAFE_PATTERNSto strip control characters and unsafe symbols deterministically.
Security
- Hardened both the regex analyzer and namespace sanitizer so untrusted input can no longer leverage those code paths for ReDoS attacks.