ReDoS Vulnerability Analysis and Fixes

@StorytellerCZ is already working on this.

Since Sep 19, 2025.

• #13936 by @StorytellerCZ — open

## Overview
This document details the analysis and fixes for Regular Expression Denial of Service (ReDoS) vulnerabilities found in the Meteor project's meteor-babel package.

## Vulnerabilities Identified

### Vulnerability 1: Whitespace Pattern
**Location**: `npm-packages/meteor-babel/test/mocha.js:5949`
**Original Pattern**: `/\s+\}$/`
**Context**: `.replace(/\s+\}$/, '');`

**Attack Vectors**:
- `""+" ".repeat(100000)+"◎"`
- `""+" ".repeat(100000)+"!"`

**Problem**: The pattern `/\s+\}$/` causes catastrophic backtracking when input contains many whitespace characters followed by a non-`}` character at the end.

### Vulnerability 2: Number Pattern
**Location**: `npm-packages/meteor-babel/test/mocha.js:6005`
**Original Pattern**: `/(\d+\.\d+)/gm`
**Context**: `.replace(/(\d+\.\d+)/gm, '$1')`

**Attack Vectors**:
- `""+"0".repeat(100000)+"."`
- `""+"1".repeat(100000)+"◎"`

**Problem**: The pattern `/(\d+\.\d+)/gm` causes excessive backtracking when input contains many digits followed by a dot but no digits after.

## Fixes Using Negative Lookahead

### Fix 1: Whitespace Pattern
```javascript
// Original (vulnerable)
.replace(/\s+\}$/, '');

// Fixed using positive lookahead
.replace(/\s+(?=\}$)/, '');
```

**Explanation**: The positive lookahead `(?=\}$)` ensures we only match whitespace that is immediately followed by `}` at the end, preventing backtracking on non-matching endings.

### Fix 2: Number Pattern
```javascript
// Original (vulnerable)
.replace(/(\d+\.\d+)/gm, '$1')

// Fixed using negative lookahead
.replace(/(\d+\.\d+)(?!\d)/gm, '$1')
```

**Explanation**: The negative lookahead `(?!\d)` ensures we don't match if there's another digit after the decimal number, making the pattern more precise and preventing backtracking.

## Security Impact

- **Severity**: Medium
- **Attack Vector**: Malicious input strings
- **Impact**: CPU exhaustion, application freeze, denial of service
- **Affected Component**: Test files (potential risk if patterns used in production)

## Testing the Fixes

### Before Fix (Vulnerable)
```javascript
// This will cause high CPU usage
const maliciousInput = " ".repeat(100000) + "◎";
const result = maliciousInput.replace(/\s+\}$/, '');
```

### After Fix (Safe)
```javascript
// This executes quickly
const maliciousInput = " ".repeat(100000) + "◎";
const result = maliciousInput.replace(/\s+(?=\}$)/, '');
```

## Recommendations

1. **Immediate**: Apply the proposed fixes to prevent ReDoS attacks
2. **Long-term**: Implement regex security scanning in CI/CD pipeline
3. **Best Practice**: Use tools like `safe-regex` to detect vulnerable patterns
4. **Code Review**: Include regex security checks in code review process

## References

- [OWASP ReDoS Guide](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)
- [Regex Security Best Practices](https://github.com/cure53/jPurify/wiki/Regular-Expression-Denial-of-Service)

Start in npm-packages/meteor-babel/test/mocha.js at the two locations identified in the issue, and review linked pull request #13936 for existing work. Reproduce the listed long-input cases before and after the proposed changes, then run the relevant meteor-babel tests to confirm the replacements remain correct and complete.

Written by the indexing model from the issue text.