HelloZeroNet / HelloZeroNet/ZeroNet
SafeRe is vulnerable to ReDoS
- Vorherrschende Sprache
- JavaScript
- Sterne
- 18.8k
- Forks
- 2.3k
- PR-Merge-Kennzahlen
- Keine gemergten PRs in 30 T.
Beschreibung
### Step 1: Please describe your environment
* ZeroNet version: 0.7.2 (4555)
### Step 2: Describe the problem:
["To avoid the ReDoS algorithmic complexity attack" ](https://zeronet.io/docs/site_development/content_json/#regular-expression-limitations) the function bellow is used to validate user defined regular expressions.
https://github.com/HelloZeroNet/ZeroNet/blob/454c0b2e7e000fda7000cba49027541fbf327b96/src/util/SafeRe.py#L10-L22
This function fails to identify regular expressions that can require exponential time complexity to match user inputs.
#### Steps to reproduce:
```
>>> from SafeRe import isSafePattern, match
>>> p = "a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
>>> isSafePattern(p)
True
>>> match(p, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
```
#### Observed Results:
`match` hangs and the execution never completes.
#### Expected Results:
`isSafePattern` should properly detect that the pattern is unsafe.
Alternatively, `match` should use an algorithm with guaranteed linear time complexity to compile and match inputs (e.g. Thompson NFA).
Beitragsleitfaden
Für dieses Repository ist kein Beitragsleitfaden indexiert
Rechercherichtung
Start with src/util/SafeRe.py lines 10-22 and reproduce the provided pattern using isSafePattern and match. Investigate how the validator handles patterns that can cause exponential matching time. Done means the example is rejected as unsafe or matching uses the proposed guaranteed-linear-time approach without hanging.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- python
- Bereich
- security
- Issue-Typ
- Bug
- Schwierigkeit
- 5/5
- Geschätzter Aufwand
- Über eine Woche
- Aktivitätsstatus
- Veraltet
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 25/100