Fixes #217 - ReDoS-safe for Java 1.8 applications

.github/workflows/master.yml

@@ -18,7 +18,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up JDK 11
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@v3
         with:
           java-version: 11
           distribution: 'temurin'
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@v3
 
       - name: Setup Java
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@v3
         with:
           distribution: 'temurin'
           java-version: ${{ matrix.java }}

README.md

@@ -72,6 +72,9 @@ switcher.snapshot.auto -> true/false Automated lookup for snapshot when loading
 switcher.snapshot.skipvalidation -> true/false Skip snapshotValidation() that can be used for UT executions
 switcher.silent -> true/false Contingency in case of some problem with connectivity with the API
 switcher.retry -> Time given to the module to re-establish connectivity with the API - e.g. 5s (s: seconds - m: minutes - h: hours)
+
+(For applications using Java 1.8 only)
+switcher.regextimeout -> Time in ms given to Timed Match used for offline Regex Operation (ReDoS safety mechanism) - 3000 default value
 ```
 
 ## Client Context Properties - SwitcherContextBase

pom.xml

@@ -60,7 +60,7 @@
 		<junit-pioneer.version>1.9.1</junit-pioneer.version>
 
 		<!-- Plugins -->
-		<maven-compiler.version>3.8.1</maven-compiler.version>
+		<maven-compiler.version>3.10.1</maven-compiler.version>
 		<maven-source.version>3.2.0</maven-source.version>
 		<maven-surefire.version>3.0.0-M5</maven-surefire.version>
 		<maven-gpg.version>3.0.1</maven-gpg.version>
@@ -73,7 +73,8 @@
 		<sonar.language>java</sonar.language>
 		<sonar.coverage.exclusions>
 	      **/model/**/*.java,
-	      **/exception/**/*.java
+	      **/exception/**/*.java,
+		  **/service/validators/RegexValidatorV8.java
 	    </sonar.coverage.exclusions>
 	</properties>
 

src/main/java/com/github/switcherapi/client/ContextBuilder.java

@@ -75,6 +75,11 @@ public ContextBuilder snapshotFile(String snapshotFile) {
 		return this;
 	}
 
+	public ContextBuilder regexTimeout(String regexTimeout) {
+		properties.setRegexTimeout(regexTimeout);
+		return this;
+	}
+
 	public ContextBuilder retryAfter(String retryAfter) {
 		properties.setRetryAfter(retryAfter);
 		return this;

src/main/java/com/github/switcherapi/client/SwitcherContext.java

@@ -29,7 +29,7 @@ public abstract class SwitcherContext extends SwitcherContextBase {
 	}
 
 	/**
-	 * Load properties from the resources folder, look up for resources/switcherapi.properties file.
+	 * Load properties from the resource's folder, look up for resources/switcherapi.properties file.
 	 * After loading the properties, it will validate the arguments and load the Switchers in memory.
 	 */
 	public static void loadProperties() {

src/main/java/com/github/switcherapi/client/SwitcherContextValidator.java

@@ -2,6 +2,7 @@
 
 import java.io.File;
 
+import com.github.switcherapi.client.model.ContextKey;
 import org.apache.commons.lang3.StringUtils;
 
 import com.github.switcherapi.client.exception.SwitcherContextException;
@@ -15,6 +16,7 @@
 class SwitcherContextValidator {
 
 	private static final String SNAPSHOT_PATH_PATTERN = "%s/%s.json";
+	private static final String ERR_FORMAT = "Invalid parameter format for [%s]. Expected %s.";
 	private static final String ERR_LOCATION_SNAPSHOT_FILE = "Snapshot locations not defined [add: switcher.snapshot.location or switcher.snapshot.file]";
 	private static final String ERR_SNAPSHOT_FILE = "Snapshot file not defined [add: switcher.snapshot.file]";
 	private static final String ERR_LOCATION = "Snapshot location not defined [add: switcher.snapshot.location]";
@@ -97,10 +99,17 @@ public static void validateOptionals(final SwitcherProperties prop) {
 		if (prop.isSnapshotAutoLoad() && StringUtils.isBlank(prop.getSnapshotLocation())) {
 			throw new SwitcherContextException(ERR_LOCATION);
 		}
-		
+
 		if (prop.isSilentMode() && StringUtils.isBlank(prop.getRetryAfter())) {
 			throw new SwitcherContextException(ERR_RETRY);
 		}
+
+		try {
+			Integer.parseInt(prop.getRegexTimeout());
+		} catch (NumberFormatException e) {
+			throw new SwitcherContextException(
+					String.format(ERR_FORMAT, ContextKey.REGEX_TIMEOUT.getParam(), Integer.class));
+		}
 	}
 
 	/**

src/main/java/com/github/switcherapi/client/SwitcherProperties.java

@@ -17,7 +17,9 @@
  */
 class SwitcherProperties {
 
-	public static final String DEFAULTENV = "default";
+	public static final String DEFAULT_ENV = "default";
+
+	public static final String DEFAULT_REGEX_TIMEOUT = "3000";
 
 	private String contextLocation;
 
@@ -37,6 +39,8 @@ class SwitcherProperties {
 
 	private String retryAfter;
 
+	private String regexTimeout;
+
 	private boolean snapshotAutoLoad;
 
 	private boolean snapshotSkipValidation;
@@ -46,7 +50,8 @@ class SwitcherProperties {
 	private boolean offlineMode;
 
 	public SwitcherProperties() {
-		this.environment = DEFAULTENV;
+		this.environment = DEFAULT_ENV;
+		this.regexTimeout = DEFAULT_REGEX_TIMEOUT;
 	}
 
 	public void loadFromProperties(Properties prop) {
@@ -63,6 +68,7 @@ public void loadFromProperties(Properties prop) {
 		setSilentMode(Boolean.parseBoolean(SwitcherUtils.resolveProperties(ContextKey.SILENT_MODE.getParam(), prop)));
 		setOfflineMode(Boolean.parseBoolean(SwitcherUtils.resolveProperties(ContextKey.OFFLINE_MODE.getParam(), prop)));
 		setRetryAfter(SwitcherUtils.resolveProperties(ContextKey.RETRY_AFTER.getParam(), prop));
+		setRegexTimeout(SwitcherUtils.resolveProperties(ContextKey.REGEX_TIMEOUT.getParam(), prop));
 	}
 
 	public <T> T getValue(ContextKey contextKey, Class<T> type) {
@@ -122,7 +128,7 @@ public void setEnvironment(String environment) {
 		if (!StringUtils.isBlank(environment))
 			this.environment = environment;
 		else
-			this.environment = DEFAULTENV;
+			this.environment = DEFAULT_ENV;
 	}
 
 	public String getSnapshotLocation() {
@@ -149,6 +155,17 @@ public void setRetryAfter(String retryAfter) {
 		this.retryAfter = retryAfter;
 	}
 
+	public String getRegexTimeout() {
+		return regexTimeout;
+	}
+
+	public void setRegexTimeout(String regexTimeout) {
+		if (!StringUtils.isBlank(regexTimeout)) {
+			this.regexTimeout = regexTimeout;
+		} else
+			this.regexTimeout = DEFAULT_REGEX_TIMEOUT;
+	}
+
 	public boolean isSnapshotAutoLoad() {
 		return snapshotAutoLoad;
 	}

src/main/java/com/github/switcherapi/client/exception/SwitcherValidatorException.java

@@ -0,0 +1,13 @@
+package com.github.switcherapi.client.exception;
+
+/**
+ * @author Roger Floriano (petruki)
+ * @since 2023-02-17
+ */
+public class SwitcherValidatorException extends SwitcherException {
+
+	public SwitcherValidatorException(final String input, final String value) {
+		super(String.format("Failed to process input [%s] for [%s]", input, value), null);
+	}
+
+}

src/main/java/com/github/switcherapi/client/model/ContextKey.java

@@ -72,7 +72,12 @@ public enum ContextKey {
 	/**
 	 * (boolean) Defines if client will work offline.
 	 */
-	OFFLINE_MODE("switcher.offline", "offlineMode");
+	OFFLINE_MODE("switcher.offline", "offlineMode"),
+
+	/**
+	 * (Number) Defines the Timed Match regex time out.
+	 */
+	REGEX_TIMEOUT("switcher.regextimeout", "regexTimeout");
 
 	private final String param;
 	private final String propField;

src/main/java/com/github/switcherapi/client/service/ValidatorService.java

@@ -24,9 +24,9 @@ private void initializeValidators() {
 		registerValidator(NetworkValidator.class);
 		registerValidator(NumericValidator.class);
 		registerValidator(PayloadValidator.class);
-		registerValidator(RegexValidator.class);
 		registerValidator(TimeValidator.class);
 		registerValidator(ValueValidator.class);
+		registerValidator(RegexValidatorV8.getPlatformValidator());
 	}
 
 	private StrategyValidator getStrategyValidator(Class<? extends Validator> validatorClass) {

src/main/java/com/github/switcherapi/client/service/validators/RegexValidator.java

@@ -1,12 +1,12 @@
 package com.github.switcherapi.client.service.validators;
 
-import java.util.Arrays;
-
 import com.github.switcherapi.client.exception.SwitcherInvalidOperationException;
 import com.github.switcherapi.client.model.Entry;
 import com.github.switcherapi.client.model.StrategyValidator;
 import com.github.switcherapi.client.model.criteria.Strategy;
 
+import java.util.Arrays;
+
 @ValidatorComponent(type = StrategyValidator.REGEX)
 public class RegexValidator extends Validator {
 
@@ -15,19 +15,19 @@ public class RegexValidator extends Validator {
 	@Override
 	public boolean process(Strategy strategy, Entry switcherInput) throws SwitcherInvalidOperationException {
 		switch (strategy.getEntryOperation()) {
-		case EXIST:
-			return Arrays.stream(strategy.getValues()).anyMatch(val -> switcherInput.getInput().matches(val));
-		case NOT_EXIST:
-			return Arrays.stream(strategy.getValues()).noneMatch(val -> switcherInput.getInput().matches(val));
-		case EQUAL:
-			return strategy.getValues().length == 1
-					&& switcherInput.getInput().matches(String.format(DELIMITER_REGEX, strategy.getValues()[0]));
-		case NOT_EQUAL:
-			return strategy.getValues().length == 1
-					&& !switcherInput.getInput().matches(String.format(DELIMITER_REGEX, strategy.getValues()[0]));
-		default:
-			throw new SwitcherInvalidOperationException(strategy.getOperation(), strategy.getStrategy());
+			case EXIST:
+				return Arrays.stream(strategy.getValues()).anyMatch(val -> switcherInput.getInput().matches(val));
+			case NOT_EXIST:
+				return Arrays.stream(strategy.getValues()).noneMatch(val -> switcherInput.getInput().matches(val));
+			case EQUAL:
+				return strategy.getValues().length == 1
+						&& switcherInput.getInput().matches(String.format(DELIMITER_REGEX, strategy.getValues()[0]));
+			case NOT_EQUAL:
+				return strategy.getValues().length == 1
+						&& !switcherInput.getInput().matches(String.format(DELIMITER_REGEX, strategy.getValues()[0]));
+			default:
+				throw new SwitcherInvalidOperationException(strategy.getOperation(), strategy.getStrategy());
 		}
 	}
 
-}
+}