ReDoS vulnerability in email regex

Code reviewSecurityMid–Senior~25 min

Review this JavaScript input-validation helper (Node.js).

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 25 min

Mark a line and say what kind of problem it is.0 findings

1// validate an email-like string from an unauthenticated signup form

2function isValidEmail(input) {

3 const re = /^([a-zA-Z0-9]+)+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;

4 return re.test(input);

7app.post('/signup', (req, res) => {

8 if (!isValidEmail(req.body.email)) {

9 return res.status(400).send('invalid email');

10 }

11 createAccount(req.body.email);

12});

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.