From f052a2c04ecb371faa8c3e1cb2c72afe0eb13618 Mon Sep 17 00:00:00 2001 From: Jamie Davis Date: Sun, 15 Apr 2018 22:16:16 -0400 Subject: [PATCH] security: fix unsafe heading regex Problem: REDOS could be triggered through exploitation of the 'heading' regex. Solution: Refactor regex. It matches the same language as before but is less vulnerable to REDOS. It is now safe using the bounds suggested by those disclosing it. It remains super-linear but a successful exploit requires a much longer attack string. Fixes: Issue disclosed privately. Credit: This issue was pointed out by Nick Starke and Adam Cazzolla of Sonatype Security research. --- lib/marked.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/marked.js b/lib/marked.js index 8012063037..ff4b7ba7bc 100644 --- a/lib/marked.js +++ b/lib/marked.js @@ -16,7 +16,7 @@ var block = { code: /^( {4}[^\n]+\n*)+/, fences: noop, hr: /^ {0,3}((?:- *){3,}|(?:_ *){3,}|(?:\* *){3,})(?:\n+|$)/, - heading: /^ *(#{1,6}) *([^\n]+?) *#* *(?:\n+|$)/, + heading: /^ *(#{1,6}) *([^\n]+?) *(?:#+ *)?(?:\n+|$)/, nptable: noop, blockquote: /^( {0,3}> ?(paragraph|[^\n]*)(?:\n|$))+/, list: /^( *)(bull) [\s\S]+?(?:hr|def|\n{2,}(?! )(?!\1bull )\n*|\s*$)/,