fix: fix Regular expression injection

acronis · Dec 17, 2024 · ebea29a · ebea29a
1 parent 797dca2
commit ebea29a
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/packages/ui/scripts/utils/fuzzyMatch.ts b/packages/ui/scripts/utils/fuzzyMatch.ts
@@ -1,9 +1,13 @@
+import { escapeRegExp } from 'lodash-es';
+
 export function fuzzyMatch(partials: string[], total: string[], includeAll = false) {
   const matched: string[] = [];
 
   partials.forEach((partial) => {
+    const safePartial = escapeRegExp(partial);
+
     for (const target of total) {
-      if (target.match(partial)) {
+      if (target.match(safePartial)) {
         matched.push(target);
 
         if (!includeAll) {