Test Case: javascript-autocomplete-813

  1rselector = new RegExp( "^" + whitespace + "*([\\w\\\\#\\.\\*\\[:]|[>+~][^>+~])+|" + whitespace + "*\\)(?=" + whitespace + "*,|$)" ),  2​  3	ridentifier = new RegExp( identifier ),  4	rattributes = new RegExp( "\\[[\\w-]+(?:[!=*$^~|]=" + attributes + ")?\\]" ),  5​  6	// Prefer arguments if not supported natively  7	hasDuplicate = false,  8	sortStable = true,

1. WARNINGLines 1 · 3 · 4

   The `RegExp` constructor was called with a non-literal value. If an adversary were able to supply a malicious regex, they could cause a Regular Expression Denial of Service (ReDoS) against the application. In Node applications, this could cause the entire application to no longer be responsive to other users' requests.

  1rselector = new RegExp( "^" + whitespace + "*([\\w\\\\#\\.\\*\\[:]+|>|\\+~(?=" + whitespace + "))+|" + whitespace + "*\\)(.*)$" ),  2​  3	// Prefer "querySelectorAll" if it's available  4	// eslint-disable-next-line eqeqeq  5	sortOrder = function( a, b ) {  6		if ( a === b ) {  7			sortStable = true;  8			return 0;  9		} 10​ 11		return a > b ? 1 : -1; 12	}, 13​ 14	// Document order sorting 15	sortDetached = support.documentElement.compareDocumentPosition ? 16		function( a, b ) { 17​ 18			// If we can sort attached nodes by document position, push detached nodes 19			if ( !a.compareDocumentPosition || !b.compareDocumentPosition ) { 20​ 21				// Use the DOM's natural comparison for detached nodes 22				return a === b ? 23					sortStable ? 24						0 : 25						-1 : 26​ 27					a.ownerDocument && !contains( a.ownerDocument, a ) ? 28						-1 : 29						b.ownerDocument && !contains( b.ownerDocument, b ) ? 30							1 : 31​ 32							// After all that, we're comparing two disconnected nodes 33							// with identical owners; use the sortOrder comparison. 34							sortOrder( a, b ); 35			} 36​ 37			return a.compareDocumentPosition( b ) & 4 ? -1 : a === b ? ( sortStable ? 0 : -1 ) : 1; 38		} : 39		function( a, b ) { 40			var cur, 41				i = 0, 42				aParents = a.parentNode, 43				bParents = b.parentNode, 44				ap = [ a ], 45				bp = [ b ]; 46​ 47			/* 48			 * When dealing with detached nodes, we need to ensure that the common ancestor 49			 * is the document or document fragment, not null 50			 */ 51			if ( !aParents || !bParents ) { 52				return a === b ? 53					sortStable ? 54						0 : 55						-1 : 56					aParents ? 57						-1 : 58						1; 59			} 60​ 61			/* 62			 * If the nodes are siblings, we can do a quick check and use the 63			 * sortOrder comparison. 64			 */ 65			if ( aParents === bParents ) { 66				return sortOrder( a, b ); 67			} 68​ 69			/* 70			 * Otherwise, we need to walk up the tree to find the common parent and 71			 * determine the order of the nodes. 72			 */ 73			cur = a; 74			while ( ( cur = cur.parentNode ) ) { 75				ap.unshift( cur ); 76			} 77			cur = b; 78			while ( ( cur = cur.parentNode ) ) { 79				bp.unshift( cur ); 80			} 81​ 82			while ( ap[ i ] === bp[ i ] ) { 83				i++; 84			} 85​ 86			return i ? 87​ 88				// If we get to this point, we've walked up the DOM and found a common ancestor. 89				// ap and bp are the series of nodes that connect each element to that ancestor. 90				// Use the sortOrder comparison to determine which node comes first. 91				sortOrder( ap[ i ], bp[ i ] ) : 92​ 93				/* 94				 * If we don't have a common ancestor, we're likely comparing two nodes from 95				 * different documents. Fall back to the sortOrder comparison. 96				 */ 97				sortOrder( a, b ); 98		};

1. WARNINGLine 1

   The `RegExp` constructor was called with a non-literal value. If an adversary were able to supply a malicious regex, they could cause a Regular Expression Denial of Service (ReDoS) against the application. In Node applications, this could cause the entire application to no longer be responsive to other users' requests.