Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Vulnerable Regular Expression

See original GitHub issue

The following regular expression used for parsing the cookie is vulnerable to ReDoS:

/^(([^=;]+))\s*=\s*([^\n\r\0]*)/

The slowdown is moderately low: for 50.000 characters around 2.5 seconds matching time. However, I would still suggest one of the following:

remove the regex,
limit the number of characters that can be matched by the repetition,
limit the input size. I noticed there is another bug report regarding the correctness of this regular expression.

If needed, I can provide an actual example showing the slowdown.

Issue Analytics

State:
Created 6 years ago
Reactions:20
Comments:22 (5 by maintainers)

Top GitHub Comments

34reactions

eddieajaucommented, Sep 21, 2017

Just fyi, nsp has this on their radar so anyone with nsp in their CI build pipeline will now be experiencing failing builds.

17reactions

stash-sfdccommented, Sep 21, 2017

Published fix as 2.3.3 - will leave this ticket open until I’ve resolved it with nsp/snyk

Top Results From Across the Web

Regular expression Denial of Service - ReDoS

The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may ......

ReDoS - Wikipedia

A regular expression denial of service (ReDoS) is an algorithmic complexity attack that produces a denial-of-service by providing a regular expression ...

Regular Expression Denial of Service (ReDoS) in scss-tokenizer

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they ...

How to protect against regex denial-of-service (ReDoS) attacks

Learn some tips to help you safeguard regular expressions against denial-of-service (DoS) attacks, known as ReDoS attacks.

Regex Vulnerabilities - ADMIN Magazine

Regular expressions are invaluable for checking user input, but a vulnerability could make them ripe for exploitation. One important paradigm in software ...