New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Regex in autoImport suffers from catastrophic backtracking #30

Closed
sluggoman opened this Issue Feb 9, 2015 · 2 comments

Comments

Projects
None yet
2 participants
@sluggoman
Copy link

sluggoman commented Feb 9, 2015

Using a key that is "copy and pasted" from a text file where "\n" character gets translated to "" and "n" characters, the regex in src/formats/pkcs8.js (and src/formats/pkcs1.js) can hang the node.js process due to (I believe) catastrophic backtracking because of the compounded qualifier in:

/^\s_-----BEGIN RSA PRIVATE KEY-----\s_([A-Za-z0-9+/=]+\s_)+-----END RSA PRIVATE KEY-----\s_$/g

(see http://www.rexegg.com/regex-explosive-quantifiers.html)

Using possessive or atomic grouping would fix the problem but the V8 engine does not support this so we need to emulate it as they suggest here:

http://instanceof.me/post/52245507631/regex-emulate-atomic-grouping-with-lookahead

So a working regex is:

/^s_-----BEGIN RSA PRIVATE KEY-----\s_(?=(([A-Za-z0-9+/=]+\s_)+))\1-----END RSA PRIVATE KEY-----\s_$/g

A test vector to repro the problem is here:

https://gist.github.com/sluggoman/999911c2c5a5436c867a#file-gistfile1-txt

Run with:

node test.js dangerous_bad

And the node process will sit at 100% CPU for a long time.

Interestingly, if you run:

node test.js dangerous_good dangerous_bad

The process doesn't hang (different path in Node's regex code the first time it encounters a regex maybe?)

At any rate, the suggested fix is safer and still properly tests keys.

@rzcoder

This comment has been minimized.

Copy link
Owner

rzcoder commented Feb 11, 2015

Hi! Can you make pull request?

@rzcoder

This comment has been minimized.

Copy link
Owner

rzcoder commented Feb 26, 2015

done

@rzcoder rzcoder closed this Feb 26, 2015

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment