Skip to content

Regular Expression DoS vulnerability in third-party script #4220

@yinxiL

Description

@yinxiL

Describe the bug
We are working on the ReDoS problem and detected a vulnerable regex from your code.

Regex \001?\033\\]((?:.|;)*?)(\x07)\002? in link takes forever to match the string
"\u001B];;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n"
This is because two branches in (?:.|;) can both match the character ;, we suggest you to just remove the later one.

We didn’t create a pull request because we're not sure if these cases are possible to take place in your program, we also do not understand the functionality of the regex as you do. Thank you for your understanding.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions