Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix catastrophic backtracking in IAL regex #125

Merged

Conversation

martosaur
Copy link
Contributor

Steps to reproduce:

  1. Open IEX
  2. Run String.duplicate("a", 500_000) |> EarmarkParser.Helpers.extract_ial()

Unless you're running a supercomputer, the operation will stall and begin to hoard memory.

The root cause is that IAL regex is doing the "catastrophic backtracking". I couldn't find a way to prevent this while still matching the line before the IAL, so instead I changed the regex to only match IAL and used Regex.split to extract the line. Let me know if you see a better solution!

We initially ran into this bug while parsing a file with base64-encoded image, so I added a test for exactly this test case.

@RobertDober
Copy link
Owner

Thank you this looks serious, hopefully I can release this during the weekend

@RobertDober RobertDober merged commit 9a84f27 into RobertDober:master Mar 3, 2023
@RobertDober
Copy link
Owner

Lets try to check this and release ASAP

@martosaur martosaur deleted the fix_ial_catastrophic_backtracking branch March 3, 2023 18:43
@martosaur martosaur restored the fix_ial_catastrophic_backtracking branch March 3, 2023 18:43
@RobertDober
Copy link
Owner

@martosaur I would not be unhappy to relinguish control maintainership of this

The young are just faster and smarter, I know this still is not the simplest code to maintain, but asking just in case. Maybe you just want commit rights, all you need is to ask ;)

Your application and colaboration is greatly appreciated.

@RobertDober
Copy link
Owner

BTW I am 61, overworked and (hopefully not seriously) sick right now, so I start searching, maybe I'll make an annonce in some near future.

@RobertDober
Copy link
Owner

1.4.31 release, thanx again

@martosaur
Copy link
Contributor Author

@RobertDober thank you for all the work you put into this repo! I don't think I can pull off being a maintainer in a truly OS fashion, but luckily enough, I do this as part of my day job so maybe we could step in as an organization! I'll start the discussion within the team.

@martosaur martosaur deleted the fix_ial_catastrophic_backtracking branch March 3, 2023 20:26
RobertDober added a commit to RobertDober/ex_doc that referenced this pull request Mar 3, 2023
The last version protects against a potential DoS attack on IALs c.f. RobertDober/earmark_parser#125
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants