fix the regular expression for function clean in utils.js#4770
fix the regular expression for function clean in utils.js#4770outsideris merged 2 commits intomochajs:masterfrom
clean in utils.js#4770Conversation
|
hey @boneskull someone from the team asked @yetingli to open a PR with a security fix; do you guys plan on merging it sometime soon? |
|
This PR hasn't had any recent activity, and I'm labeling it |
|
I am voting for this to be merged ASAP. |
|
Reported in huntr https://www.huntr.dev/bounties/1d8a3d95-d199-4129-a6ad-8eafe5e77b9e/ Please |
|
@yetingli We missed it. Sorry for the late response. @mochajs/core I will merge this in a few days after CLA. After merging this PR, I will add a test for ReDos. |
|
Hi @outsideris, thank you for your response! And I have signed the CLA. Please |
|
@yetingli Okay, It's my first time using Huntr. I will try it after merging this. |
|
Which mocha version has this fix? 10.0.0 is still giving the same issue. |
|
@outsideris sorry to bother, but can a new version be published with this fix? Our security tools are complaining... |
|
@sauravlikhar @heidemn-faro the fix is now published in version 10.1.0 |
|
is it fixed??? 10.2.0 is still giving this error |
Description of the Change
Fix the regular expression for function
cleaninutils.jsto avoid potential Regular Expression Denial of Service (ReDoS) vulnerabilities.Alternate Designs
The ReDoS vulnerabilities of the regex
/^function(?:\s*|\s+[^(]*)\([^)]*\)\s*\{((?:.|\n)*?)\s*\}$|^\([^)]*\)\s*=>\s*(?:\{((?:.|\n)*?)\s*\}|((?:.|\n)*))$/are mainly due to the overlapped sub-patterns\s+[^(]*and((?:.|\n)*?)\s*.We can ignore
\sfirst, because in the end, we can also deal with\susing thetrimfunction (see the code below）mocha/lib/utils.js
Line 92 in 8421974
So I am willing to suggest that you replace the ReDoS-vulnerable regex
/^function(?:\s*|\s+[^(]*)\([^)]*\)\s*\{((?:.|\n)*?)\s*\}$|^\([^)]*\)\s*=>\s*(?:\{((?:.|\n)*?)\s*\}|((?:.|\n)*))$/with the safe regex/^function(?:\s*|\s[^(]*)\([^)]*\)\s*\{((?:.|\n)*?)\}$|^\([^)]*\)\s*=>\s*(?:\{((?:.|\n)*?)\}|((?:.|\n)*))$/Benefits
It achieves functional equivalence and is not subject to ReDoS attacks.
Applicable issues
See the link https://www.huntr.dev/bounties/1d8a3d95-d199-4129-a6ad-8eafe5e77b9e/