facebook / facebook/duckling

Time interval data causing hang (potential regex dos vulnerability)

Đang mở
#338 5 bình luận 5 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Haskell
Star
4.3k
Fork
740
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

While running duckling over a large set of data, I ran across a particular example that caused it to hang reproducibly. Trying to extract `time` from the following text:
```
from 10.00am on Friday 15th April 2016 until 10.00am on Tuesday 19th April 2016
```

This example does not cause a crash or traceback, it just causes an infinite hang until the thread is killed. My best guess is
- a regex dos caused by a badly written pattern
- a recursive call function call

Both clauses (`from` and `until`) need to be present, neither is sufficient to cause a crash on its own. Removing trivial parts of the text allows the function call to return:

```
# empty response (thread killed)
"from 10.00am on Friday 15th April 2016 until 10.00am on Tuesday 19th April 2016"
# very slow
"from 10.00am Friday 15 April 2016 until 10.00am Tuesday 19 April 2016"
# works
"from 10.00am Friday 15 April until 10.00am Tuesday 19 April"
```

---

See #339 for a branch reproducing this case.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.