Skip to content

Commit 0789e21

Browse files
committed
fix ReDos in hwb() parser (low-severity)
Discovered by Yeting Li, c/o Colin Ife via Snyk.io. A ReDos (Regular Expression Denial of Service) vulnerability was responsibly disclosed to me via email by Colin on Mar 5 2021 regarding an exponential time complexity for linearly increasing input lengths for `hwb()` color strings. Strings reaching more than 5000 characters would see several milliseconds of processing time; strings reaching more than 50,000 characters began seeing 1500ms (1.5s) of processing time. The cause was due to a the regular expression that parses hwb() strings - specifically, the hue value - where the integer portion of the hue value used a 0-or-more quantifier shortly thereafter followed by a 1-or-more quantifier. This caused excessive backtracking and a cartesian scan, resulting in exponential time complexity given a linear increase in input length. Thank you Yeting Li and Colin Ife for bringing this to my attention in a secure, responsible and professional manner. A CVE will not be assigned for this vulnerability.
1 parent 60f3f66 commit 0789e21

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

index.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ cs.get.hsl = function (string) {
129129
return null;
130130
}
131131

132-
var hsl = /^hsla?\(\s*([+-]?(?:\d*\.)?\d+)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?[\d\.]+)\s*)?\)$/;
132+
var hsl = /^hsla?\(\s*([+-]?(?:\d{0,3}\.)?\d+)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?[\d\.]+)\s*)?\)$/;
133133
var match = string.match(hsl);
134134

135135
if (match) {
@@ -150,7 +150,7 @@ cs.get.hwb = function (string) {
150150
return null;
151151
}
152152

153-
var hwb = /^hwb\(\s*([+-]?\d*[\.]?\d+)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?[\d\.]+)\s*)?\)$/;
153+
var hwb = /^hwb\(\s*([+-]?\d{0,3}(?:\.\d+)?)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?[\d\.]+)\s*)?\)$/;
154154
var match = string.match(hwb);
155155

156156
if (match) {

0 commit comments

Comments
 (0)