security: vulnerable regex

[davisjam]

(18:57:29) jamie@woody ~/Desktop/floss/marked $ npm run test:redos

> marked@0.3.19 test:redos /home/jamie/Desktop/floss/marked
> eslint --plugin vuln-regex-detector --rule '"vuln-regex-detector/no-vuln-regex": 2' lib/marked.js


/home/jamie/Desktop/floss/marked/lib/marked.js
  557:14  error  Regex pattern vulnerable to catastrophic backtracking: ^!?\[(label)\]\(\s*<?([\s\S]*?)>?(?:\s+(['"][\s\S]*?['"]))?\s*\)  vuln-regex-detector/no-vuln-regex

[UziTech]

out of curiosity what is the part of this regex that is vulnerable?

[davisjam]

The issue is the quantified adjacent whitespaces here: \s*<?[\s\S]*>?\s+. The angle brackets are optional so input including a ton of whitespace can be problematic.

[UziTech]

wouldn't some thing like this solve it?

...\s*(<[\s\S]*?>|[^\s]+)(?:\s+...

no more quantified adjacent whitespaces

[UziTech]

and the angle brackets are already being taken out of the url by this line

[davisjam]

...\s*(<[\s\S]*?>|[^\s]+)(?:\s+...

This would not solve it, just change the form it took. On malicious input of the form <<...< it would have to decide between the left or right node in the disjunction. Backtracking manifests around 10K <s and gets worse as you increase.