fix(issue-275): coalesce 2 or more asterisks into 2

Eliminating ReDoS risk: #275

Author: Tamas Perger

minimatch.js

@@ -165,6 +165,8 @@ class Minimatch {
   constructor (pattern, options) {
     assertValidPattern(pattern)
 
+    pattern = pattern.replace(new RegExp("\\*\\*+", "g"), "**")
+
     if (!options) options = {}
 
     this.options = options

tap-snapshots/test/basic.js.test.cjs

@@ -74,15 +74,15 @@ exports[`test/basic.js TAP basic tests > makeRe ** 3`] = `
 `
 
 exports[`test/basic.js TAP basic tests > makeRe *******? 1`] = `
-/^(?:(?!\\.)(?=.)[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/])$/
+/^(?:(?!\\.)(?=.)[^/]*?[^/]*?[^/])$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe *******c 1`] = `
-/^(?:(?!\\.)(?=.)[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?c)$/
+/^(?:(?!\\.)(?=.)[^/]*?[^/]*?c)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe *****?? 1`] = `
-/^(?:(?!\\.)(?=.)[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/][^/])$/
+/^(?:(?!\\.)(?=.)[^/]*?[^/]*?[^/][^/])$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe **/.x/** 1`] = `
@@ -138,35 +138,35 @@ exports[`test/basic.js TAP basic tests > makeRe /^root:/{s/^[^:]*:[^:]*:([^:]*).
 `
 
 exports[`test/basic.js TAP basic tests > makeRe ?************c****?**** 1`] = `
-/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?c[^/]*?[^/]*?[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/]*?[^/]*?)$/
+/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?c[^/]*?[^/]*?[^/][^/]*?[^/]*?)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe ?*****?? 1`] = `
-/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/][^/])$/
+/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/][^/])$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe ?*****?c 1`] = `
-/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]c)$/
+/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/]c)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe ?***?**** 1`] = `
-/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/]*?[^/]*?)$/
+/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/][^/]*?[^/]*?)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe ?***?****? 1`] = `
-/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/]*?[^/]*?[^/])$/
+/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/][^/]*?[^/]*?[^/])$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe ?***?****c 1`] = `
-/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/]*?[^/]*?c)$/
+/^(?:(?!\\.)(?=.)[^/][^/]*?[^/]*?[^/][^/]*?[^/]*?c)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe ??**********?****? 1`] = `
-/^(?:(?!\\.)(?=.)[^/][^/][^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/]*?[^/]*?[^/])$/
+/^(?:(?!\\.)(?=.)[^/][^/][^/]*?[^/]*?[^/][^/]*?[^/]*?[^/])$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe ??**********?****c 1`] = `
-/^(?:(?!\\.)(?=.)[^/][^/][^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/]*?[^/]*?c)$/
+/^(?:(?!\\.)(?=.)[^/][^/][^/]*?[^/]*?[^/][^/]*?[^/]*?c)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe @(*|.*) 1`] = `
@@ -342,39 +342,39 @@ exports[`test/basic.js TAP basic tests > makeRe a* 1`] = `
 `
 
 exports[`test/basic.js TAP basic tests > makeRe a********???******* 1`] = `
-/^(?:(?=.)a[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/][^/][^/][^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?)$/
+/^(?:(?=.)a[^/]*?[^/]*?[^/][^/][^/][^/]*?[^/]*?)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe a*****?c 1`] = `
-/^(?:(?=.)a[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]c)$/
+/^(?:(?=.)a[^/]*?[^/]*?[^/]c)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe a*****c*?** 1`] = `
-/^(?:(?=.)a[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?c[^/]*?[^/][^/]*?[^/]*?)$/
+/^(?:(?=.)a[^/]*?[^/]*?c[^/]*?[^/][^/]*?[^/]*?)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe a****c**?**??***** 1`] = `
-/^(?:(?=.)a[^/]*?[^/]*?[^/]*?[^/]*?c[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/][^/][^/]*?[^/]*?[^/]*?[^/]*?[^/]*?)$/
+/^(?:(?=.)a[^/]*?[^/]*?c[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/][^/][^/]*?[^/]*?)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe a***c 1`] = `
-/^(?:(?=.)a[^/]*?[^/]*?[^/]*?c)$/
+/^(?:(?=.)a[^/]*?[^/]*?c)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe a**?**cd**?**??***k 1`] = `
-/^(?:(?=.)a[^/]*?[^/]*?[^/][^/]*?[^/]*?cd[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/][^/][^/]*?[^/]*?[^/]*?k)$/
+/^(?:(?=.)a[^/]*?[^/]*?[^/][^/]*?[^/]*?cd[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/][^/][^/]*?[^/]*?k)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe a**?**cd**?**??***k** 1`] = `
-/^(?:(?=.)a[^/]*?[^/]*?[^/][^/]*?[^/]*?cd[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/][^/][^/]*?[^/]*?[^/]*?k[^/]*?[^/]*?)$/
+/^(?:(?=.)a[^/]*?[^/]*?[^/][^/]*?[^/]*?cd[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/][^/][^/]*?[^/]*?k[^/]*?[^/]*?)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe a**?**cd**?**??k 1`] = `
 /^(?:(?=.)a[^/]*?[^/]*?[^/][^/]*?[^/]*?cd[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/][^/]k)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe a**?**cd**?**??k*** 1`] = `
-/^(?:(?=.)a[^/]*?[^/]*?[^/][^/]*?[^/]*?cd[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/][^/]k[^/]*?[^/]*?[^/]*?)$/
+/^(?:(?=.)a[^/]*?[^/]*?[^/][^/]*?[^/]*?cd[^/]*?[^/]*?[^/][^/]*?[^/]*?[^/][^/]k[^/]*?[^/]*?)$/
 `
 
 exports[`test/basic.js TAP basic tests > makeRe a*[^c] 1`] = `

test/redos2.js

@@ -0,0 +1,12 @@
+var t = require('tap')
+
+var minimatch = require('../')
+
+// Fixing https://github.com/isaacs/minimatch/issues/275
+var exploit = '***************X***************************************'
+
+// Valid match, no timeout
+t.ok(minimatch('___________________________________X___', exploit))
+
+// No match, no timeout
+t.notOk(minimatch('___________________________________z___', exploit))