Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Optimize data format key name regular expression #1807

Closed
ghost opened this issue Mar 13, 2021 · 0 comments
Closed

Optimize data format key name regular expression #1807

ghost opened this issue Mar 13, 2021 · 0 comments
Labels
Milestone

Comments

@ghost
Copy link

ghost commented Mar 13, 2021

A regexploit analysis shows:

Vulnerable regex in ./intelmq/lib/message.py #115
Pattern: ^[a-z_](.[a-z_0-9]+)*$
Context: if not re.match('^[a-z_](.[a-z_0-9]+)*$', harm_key) and harm_key != '__type':
---
Redos(starriness=11, prefix_sequence=SEQ{ [5f:_,[a-z]] }, redos_sequence=SEQ{ [5f:_,[a-z],[0-9]]{2+}{0+} $[5f:_,[a-z],[0-9]] }, repeated_character=[5f:_,[a-z],[0-9]], killer=[^5f:_,[a-z],[0-9]])
Worst-case complexity: 11 ⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐ (exponential)
Repeated character: [5f:_,[a-z],[0-9]]
Final character to cause backtracking: [^5f:_,[a-z],[0-9]]
Example: 'a' + '0' * 3456 + 'A'

The expression can be optimized and should be pre-compiled as well.

The check also only needs to be performed for the extra-keys, as the others are defined anyway.

@ghost ghost self-assigned this Aug 20, 2021
@ghost ghost added this to the 3.1.0 milestone Aug 20, 2021
ghost pushed a commit that referenced this issue Aug 20, 2021
if they match the regular expression for key names

fixes #1807
ghost pushed a commit that referenced this issue Aug 20, 2021
if they match the regular expression for key names

fixes #1807
ghost pushed a commit that referenced this issue Aug 20, 2021
if they match the regular expression for key names

fixes #1807
ghost pushed a commit that referenced this issue Aug 20, 2021
if they match the regular expression for key names

fixes #1807
ghost pushed a commit that referenced this issue Aug 20, 2021
if they match the regular expression for key names

fixes #1807
ghost pushed a commit that referenced this issue Aug 20, 2021
if they match the regular expression for key names

fixes #1807
@ghost ghost added the security label Aug 20, 2021
ghost pushed a commit that referenced this issue Aug 23, 2021
if they match the regular expression for key names

fixes #1807
ghost pushed a commit that referenced this issue Aug 23, 2021
if they match the regular expression for key names

fixes #1807
@ghost ghost closed this as completed in 7635c60 Aug 23, 2021
waldbauer-certat pushed a commit that referenced this issue Sep 9, 2021
if they match the regular expression for key names

fixes #1807
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

0 participants