Vulnerable Regular Expression in vfsjfilechooser2 about vfsjfilechooser2 HOT 5 CLOSED

Thanks for that. Tested and incorporated the fix. Also fixed handling of specials chars in passwords, which need to be URL encoded. Pushed out a new release (0.2.9) to Maven Central.

from vfsjfilechooser2.

This project hasn't been under active development for a number of years (I no longer use it). Propose a patch that mitigates the problem and I'll have a look at it.

from vfsjfilechooser2.

This project hasn't been under active development for a number of years (I no longer use it). Propose a patch that mitigates the problem and I'll have a look at it.

I am willing to suggest that you replace the Pattern p_ftp2 (ftp|FTP|sftp|SFTP|http|HTTP|https|HTTPS|webdav|WEBDAV|smb|SMB)://(.+:.+@)*([^:]+?/*)([ ]*:[0-9]+)*([ ]*:)*(/.*) with (ftp|FTP|sftp|SFTP|http|HTTP|https|HTTPS|webdav|WEBDAV|smb|SMB)://([^:@]+:[^:@]+@)*([^:]+?/*)([ ]*:[0-9]+)*([ ]*:)*(/.*)

Similarly, Pattern p_ftp3 can also be modified in this way.

Feel free to contact me if you have any questions on these vulnerability disclosures :).

from vfsjfilechooser2.

Hi, Was CVE-2021-29061 fixed?
If so, in what commit/version?

Thanks!!

from vfsjfilechooser2.

0.2.9 as it says in the comment before your comment.

from vfsjfilechooser2.