fix(compiler): prevent ReDoS in i18n placeholder name extraction#69907
Open
arshsmith1 wants to merge 1 commit into
Open
fix(compiler): prevent ReDoS in i18n placeholder name extraction#69907arshsmith1 wants to merge 1 commit into
arshsmith1 wants to merge 1 commit into
Conversation
The regex that reads the name from a `//i18n(ph="NAME")` annotation on an interpolation expression chained five greedy `[\s\S]*` segments between the literals `i18n`, `(`, `ph`, `=` and the opening quote. When the prefix matches but the closing quote/paren is missing, a run of `i18n(ph=` text can be split across those wildcards in many ways, so the match backtracks catastrophically (`'//' + 'i18n(ph='.repeat(200)`, ~1.6 KB, takes ~96s). The separators in that annotation are only ever whitespace, so bind them to `\s*` and stop the name at the delimiter quote. Valid annotations are still recognized identically; the match is now linear.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Checklist
PR Type
What is the current behavior?
Issue Number: N/A
extractPlaceholderNamereads the name out of a//i18n(ph="NAME")annotation on an interpolation expression with_CUSTOM_PH_EXP:[\s\S]*segments between the short literalsi18n,(,ph,=and the opening quote.i18n(ph=characters can be partitioned across those wildcards in exponentially many ways, so the match backtracks catastrophically.An interpolation expression of
'//' + 'i18n(ph='.repeat(200)(about 1.6 KB) takes ~96s to extract. This runs at template-compile time and, under JIT, in the browser when the interpolation text inside an i18n element comes from an untrusted source.What is the new behavior?
\s*instead of[\s\S]*.((?:(?!\1)[\s\S])*)group, so the name scan no longer runs to end-of-input.Recognized annotations are unchanged for valid input (the existing named-interpolation cases still pass); the same 1.6 KB input now resolves in well under a millisecond. Added a regression test covering an unterminated annotation.
Does this PR introduce a breaking change?
Other information