[core] Potential ReDoS Vulnerability or Inefficient Regular Expression in Project: Need for Assessment and Mitigation

[mmmsssttt404]

Steps to reproduce
Hello,

I am writing to report a potential Regular Expression Denial of Service (ReDoS) vulnerability or Inefficient Regular Expression in the project. When using specially crafted input strings in the context, it may lead to extremely high CPU usage, application freezing, or denial of service attacks.

Location of Issue:

The vulnerability is related to a regular expression used in the following validation file, which may result in significantly prolonged execution times under certain conditions.

brace-expansion/index.js

Line 157 in 6a39bdd

if (m.post.match(/,.*\}/)) {

PoC Files and Comparisons:
gist:https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466
use time:

Proposed Solution:
Change the regular expression to

,(?!,).*\}

change:
https://github.com/mmmsssttt404/brace-expansion/blob/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5/index.js#L157

Thank you for your attention to this matter. Your evaluation and response to this potential security concern would be greatly appreciated.

Best regards,

Search keywords: ReDoS

[Soneliem]

Can this PR be reviewed and merged considering this: GHSA-v6h2-p8h4-qcjw
@juliangruber

[jespinosadf]

Hi @juliangruber, please accept the PR :D

[watson]

@isaacs I think you have admin write permissions to this repo as well?

[juliangruber]

https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1

[silverwind]

Could this be backported to v2 and v3 releases?

[viceice]

please also v1 because it's trasitively used by minimatch (especially by popular eslint package)

[juliangruber]

https://github.com/juliangruber/brace-expansion/releases/tag/v3.0.1

[juliangruber]

https://github.com/juliangruber/brace-expansion/releases/tag/v2.0.2

[juliangruber]

https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.12

[juliangruber]

@someonestolemyusername pull requests improving the test welcome

[qwilr-altonius]

Danke @juliangruber!

[viceice]

Now the advisory needs to be updated, tried it, but it seems i did a mistake 😕

• [GHSA-v6h2-p8h4-qcjw] brace-expansion Regular Expression Denial of Service vulnerability github/advisory-database#5701

[breadadams]

Thanks for backporting the fix @juliangruber! I noticed it's been released on GitHub, but not published to npm yet.

Is that something you're working on still?

[watson]

@breadadams it has been released to npm as well

[juliangruber]

@breadadams https://www.npmjs.com/package/brace-expansion?activeTab=versions