| CVE | Vulnerability name | Date | Responsible Security Disclosure by | Vulnerabilities |
|---|---|---|---|---|
|
-
|
RouteBleed |
2026-08-17 |
GitHub CodeQL (code scanning alert #434) and xet7 (fix)
Automated code scanning flagged incomplete regular-expression escaping. |
|
The board export scope regression test reads every export path offered by the UI and checks that a matching server route parses the selected fields. It built a regular expression from each route path and attempted to escape the path first:
// vulnerable — escapes forward slashes only
const route = new RegExp(`'/api/boards/:boardId/${p.replace(/\//g, '\\/')}'`);
Forward slash has no special meaning inside a regular expression created with the
RegExp constructor. Meanwhile the characters that do have special meaning —
. * + ? ^ $ { } ( ) | [ ] \ — remained unescaped. In particular, a backslash
in the input can change how the character after it is interpreted. The resulting pattern can
therefore match a different route, fail to match the intended route, or fail to compile.
This was test-only code operating on a hardcoded table of export paths. It is not included in a WeKan server or browser bundle, and no request or user-controlled value reaches it. There was consequently no runtime attack surface and no denied operation to record in Admin Panel → Problems. The security value of the fix is correctness: a route coverage test must not report coverage for a route that is not really present.
Fix: remove the regular expression. The test wants an exact JavaScript route literal,
so it now builds that literal and uses server.includes(route). This follows
CodeQL's safest recommendation: design the comparison so sanitization is unnecessary.
// fixed — literal text is compared as literal text
const route = `'/api/boards/:boardId/${p}'`;
server.includes(route);
Positive coverage verifies an exact route containing backslashes and regular-expression metacharacters is found. The negative case changes one literal dot-position character and proves it no longer matches. A repository-wide source guard also rejects the exact slash-only escaping shape from alert #434 and proves it catches the vulnerable construction while allowing the complete metacharacter escape used where a dynamic pattern is genuinely required.