facebook / facebook/duckling

Time interval data causing hang (potential regex dos vulnerability)

Abierto
#338 5 comentarios 5 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Haskell
Estrellas
4.3k
Forks
740
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

While running duckling over a large set of data, I ran across a particular example that caused it to hang reproducibly. Trying to extract `time` from the following text:
```
from 10.00am on Friday 15th April 2016 until 10.00am on Tuesday 19th April 2016
```

This example does not cause a crash or traceback, it just causes an infinite hang until the thread is killed. My best guess is
- a regex dos caused by a badly written pattern
- a recursive call function call

Both clauses (`from` and `until`) need to be present, neither is sufficient to cause a crash on its own. Removing trivial parts of the text allows the function call to return:

```
# empty response (thread killed)
"from 10.00am on Friday 15th April 2016 until 10.00am on Tuesday 19th April 2016"
# very slow
"from 10.00am Friday 15 April 2016 until 10.00am Tuesday 19 April 2016"
# works
"from 10.00am Friday 15 April until 10.00am Tuesday 19 April"
```

---

See #339 for a branch reproducing this case.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.