Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Regex in autoImport suffers from catastrophic backtracking #30
Using a key that is "copy and pasted" from a text file where "\n" character gets translated to "" and "n" characters, the regex in src/formats/pkcs8.js (and src/formats/pkcs1.js) can hang the node.js process due to (I believe) catastrophic backtracking because of the compounded qualifier in:
/^\s_-----BEGIN RSA PRIVATE KEY-----\s_([A-Za-z0-9+/=]+\s_)+-----END RSA PRIVATE KEY-----\s_$/g
Using possessive or atomic grouping would fix the problem but the V8 engine does not support this so we need to emulate it as they suggest here:
So a working regex is:
/^s_-----BEGIN RSA PRIVATE KEY-----\s_(?=(([A-Za-z0-9+/=]+\s_)+))\1-----END RSA PRIVATE KEY-----\s_$/g
A test vector to repro the problem is here:
node test.js dangerous_bad
And the node process will sit at 100% CPU for a long time.
Interestingly, if you run:
node test.js dangerous_good dangerous_bad
The process doesn't hang (different path in Node's regex code the first time it encounters a regex maybe?)
At any rate, the suggested fix is safer and still properly tests keys.