HelloZeroNet / HelloZeroNet/ZeroNet
SafeRe is vulnerable to ReDoS
- Dominant language
- JavaScript
- Stars
- 18.8k
- Forks
- 2.3k
- PR merge metrics
- No merged PRs in 30d
Description
### Step 1: Please describe your environment
* ZeroNet version: 0.7.2 (4555)
### Step 2: Describe the problem:
["To avoid the ReDoS algorithmic complexity attack" ](https://zeronet.io/docs/site_development/content_json/#regular-expression-limitations) the function bellow is used to validate user defined regular expressions.
https://github.com/HelloZeroNet/ZeroNet/blob/454c0b2e7e000fda7000cba49027541fbf327b96/src/util/SafeRe.py#L10-L22
This function fails to identify regular expressions that can require exponential time complexity to match user inputs.
#### Steps to reproduce:
```
>>> from SafeRe import isSafePattern, match
>>> p = "a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
>>> isSafePattern(p)
True
>>> match(p, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
```
#### Observed Results:
`match` hangs and the execution never completes.
#### Expected Results:
`isSafePattern` should properly detect that the pattern is unsafe.
Alternatively, `match` should use an algorithm with guaranteed linear time complexity to compile and match inputs (e.g. Thompson NFA).
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.