Merge pull request #78 from Hexastack/77-issue-regular-expression-inj…

…ection

fix: escape regular expressions

api/migrations/config/create.ts

@@ -11,6 +11,8 @@
 import fs from 'fs';
 import path from 'path';
 
+import escapeRegExp from 'lodash/escapeRegExp';
+
 // Get the argument passed (e.g., "all-users-fr")
 const arg: string | undefined = process.argv[2];
 
@@ -25,7 +27,7 @@ const templatePath: string = path.join(__dirname, '../config/template.ts');
 
 // Check if a migration with the same name (excluding timestamp) already exists
 const migrationExists: boolean = fs.readdirSync(migrationsDir).some((file) => {
- const regex = new RegExp(`^[0-9]+-${arg}\.ts$`);
+ const regex = new RegExp(`^[0-9]+-${escapeRegExp(arg)}\\.ts$`);
  return regex.test(file);
 });
 

api/package.json

@@ -91,6 +91,7 @@
  "@types/express": "^4.17.17",
  "@types/express-session": "^1.17.10",
  "@types/jest": "^29.5.2",
+ "@types/lodash": "^4.17.9",
  "@types/module-alias": "^2.0.4",
  "@types/multer": "^1.4.11",
  "@types/node": "^20.3.1",

api/src/utils/pipes/search-filter.pipe.ts

@@ -13,6 +13,7 @@ import {
  ArgumentMetadata,
  Logger,
 } from '@nestjs/common';
+import escapeRegExp from 'lodash/escapeRegExp';
 import { TFilterQuery, Types } from 'mongoose';
 
 import {
@@ -36,9 +37,8 @@ export class SearchFilterPipe<T>
  }
 
  private getRegexValue(val: string) {
- const quote = (str: string) =>
- str.replace(/([.?*+^$[\]\\(){}|-])/g, '\\$1');
- return new RegExp(quote(val), 'i');
+ const escapedRegExp = escapeRegExp(val);
+ return new RegExp(escapedRegExp, 'i');
  }
 
  private isAllowedField(field: string) {