HelloZeroNet / HelloZeroNet/ZeroNet

SafeRe is vulnerable to ReDoS

Open
#2,757 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
18.8k
Forks
2.3k
PR merge metrics
No merged PRs in 30d

Description

### Step 1: Please describe your environment

* ZeroNet version: 0.7.2 (4555)

### Step 2: Describe the problem:

["To avoid the ReDoS algorithmic complexity attack" ](https://zeronet.io/docs/site_development/content_json/#regular-expression-limitations) the function bellow is used to validate user defined regular expressions.

https://github.com/HelloZeroNet/ZeroNet/blob/454c0b2e7e000fda7000cba49027541fbf327b96/src/util/SafeRe.py#L10-L22

This function fails to identify regular expressions that can require exponential time complexity to match user inputs.

#### Steps to reproduce:

```
>>> from SafeRe import isSafePattern, match
>>> p = "a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
>>> isSafePattern(p)
True
>>> match(p, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
```

#### Observed Results:
`match` hangs and the execution never completes.

#### Expected Results:
`isSafePattern` should properly detect that the pattern is unsafe.
Alternatively, `match` should use an algorithm with guaranteed linear time complexity to compile and match inputs (e.g. Thompson NFA).

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.