[OutSystems UI] Breaking Change in version 3.0.0

Back to Forums

Magnus

Solved

Question

Reactive

Forge

OutSystems 11

Application Type

Reactive

Hello,

for version 3.0.0 following breaking change is listed:

URL.IsValid Removed: Removed the deprecated OSFramework.OSUI.Helper.URL.IsValid JavaScript function, which was affected by a potential ReDoS (catastrophic backtracking) vulnerability. Use the native URL constructor instead. (ROU-13054 / RPM-7202)

How can I verify if an application is affected by this breaking change?

Thanks & best regards,

Magnus

1 day ago

Ricardo Monteiro

Solution

Hi @Magnus,

OSFramework.OSUI.Helper.URL.IsValid was an internal JS helper, never exposed as a client action and not used anywhere else in OutSystems UI. You’re only affected if your own JavaScript (JS nodes, scripts, other Forge components) calls it. Search for URL.IsValid.

1 day ago

1 reply

11 hours ago

Show thread

Hide thread

Magnus

Thank you!

Unfortunately, this is yet another unnecessary breaking change. Why not simply change the internal JS helper implementation to use the native URL constructor instead of recommending that every customer check every application and change it to use the native URL constructor? :-(

11 hours ago

Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.

See the full guidelines