AdguardTeam / AdguardTeam/FiltersCompiler

Protection from ReDos

Aperta
#162 0 commenti 1 reazione 0 assegnatari Vedi su GitHub
enhancement
Lingua principale
JavaScript
Stelle
64
Fork
11
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

Check this issue:
https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2240

The point is that a poor regular expression may cause the extension to completely break the browser.
I suggest adding more checks for regular expressions in the filtering rules.

More on catastrophic backtracking and relevant articles:
* https://javascript.info/regexp-catastrophic-backtracking#back-to-words-and-strings
* https://api7.ai/blog/how-to-avoid-catastrophic-backtracking-completely
* https://github.com/NicolaasWeideman/RegexStaticAnalysis

Instead of static analysis, we may consider checking every regular expression against a few hundreds of random URLs and detect the "slow regexes" this way.

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.