Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

bignumber: parseFixed now contains a ReDoS since a9cdbe1238c149a7167c6bb1a78f314805b52755

See original GitHub issue

The new regex introduced in a9cdbe1238c149a7167c6bb1a78f314805b52755 contains an IDA, and could cause a ReDoS on some crafted input.

import { parseFixed } from '@ethersproject/bignumber'

console.log(parseFixed('0.' + '0'.repeat(8e6) + '1')) // hangs

Issue Analytics

State:
Created 2 years ago
Reactions:1
Comments:5 (3 by maintainers)

Top GitHub Comments

2reactions

ricmoocommented, Sep 16, 2021

Thanks! This will be fixed with #2016, which is removing the regex entirely.

Huge thanks for the info on ReDoS though, I need to spend more time understanding the intricacies of it.

Reminds me of the quote: “You have problem and think to yourself, ‘I know! I can use a regular expression’. Now you have two problems.” 😃

0reactions

ChALkeRcommented, Oct 1, 2021

This is now fixed.

Top Results From Across the Web

Developers - bignumber: parseFixed now contains a ReDoS since ...

The new regex introduced in a9cdbe1238c149a7167c6bb1a78f314805b52755 contains an IDA, and could cause a ReDoS on some crafted input. import { parseFixed } ...