Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix a ReDoS in 'style' format #180

Merged
merged 1 commit into from Jun 29, 2020
Merged

Conversation

ChALkeR
Copy link
Contributor

@ChALkeR ChALkeR commented Jun 29, 2020

Filing a public PR as requested.

As there are no ^ or $ anchors in the regex, this should be equivalent.
Patch deliberately does not change the behavior.

If the intent was to include ^ and $ and those were missed due to an unrelated mistake, I can probably propose another safe regex for that (but that would change the behavior).

Please recheck that this regex is correct.

As there are no `^` or `$` anchors in the regex, this should be equivalent.
Patch deliberately does not change the behavior.
LinusU
LinusU approved these changes Jun 29, 2020
Copy link
Collaborator

@LinusU LinusU left a comment

Thanks, the changes looks good from what I can tell.

I don't understand what the uses case for this is though 😂

I think that we should deprecated style and remove it in the next major. As it currently behaves, it seems to open, it basically accepts anything with a colon in it, and we cannot change it without a breaking change...

@LinusU
Copy link
Collaborator

LinusU commented Jun 29, 2020

I will merge and release this right away since it seems like a change that would be nice to get out to users as fast a possible. Thank you for finding and fixing this!

@LinusU LinusU merged commit 22c6b76 into mafintosh:master Jun 29, 2020
1 check passed
@LinusU
Copy link
Collaborator

LinusU commented Jun 29, 2020

Released as 2.20.4

@LinusU
Copy link
Collaborator

LinusU commented Jun 29, 2020

btw.

Filing a public PR as requested.

I'm guessing that you talked to Mathias, is there anywhere where I should add my email address as well so that we both can get notified next time?

@ChALkeR
Copy link
Contributor Author

ChALkeR commented Jun 29, 2020

I think that we should deprecated style and remove it in the next major. As it currently behaves, it seems to open, it basically accepts anything with a colon in it, and we cannot change it without a breaking change...

Being open is not a problem of the style only, but is a deep problem of both this validation library (and other ones too) and the JSON Schema spec itself.

I fixed that in a rewrite (along with a number of other issues). Docs on technical decisions and the reasoning behind the changes are still in progress, but switching to not failing open everywhere was the most significant reason.

That induced a mostly complete rewrite of the lib and it can't be fixed with minor changes, I believe. I'll document those things soonish.

I'm guessing that you talked to Mathias, is there anywhere where I should add my email address as well so that we both can get notified next time?

That went via https://github.com/nodejs/security-wg and https://hackerone.com/nodejs-ecosystem.
I'll ask to add you to the reports if I will send any more reports -- that would require a http://hackerone.com/ account.
But it's unlikely that I will file anything else, I suppose, as the already described problems were mostly fixed in the recent commits.

@LinusU
Copy link
Collaborator

LinusU commented Jun 30, 2020

Nice 👍

My HackerOne username is: linusu

This was referenced Mar 9, 2021
This was referenced Mar 15, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants