ReDoS vulnerability in page_parse.py

[xywang18]

Description

ReDoS vulnerability is an algorithmic complexity vulnerability that usually appears in backtracking-kind regex engines, e.g. the python default regex engine. The attacker can construct malicious input to trigger the worst-case time complexity of the regex engine to make a denial-of-service attack.

In this project, here has used the ReDoS vulnerable regex (?=<!--)([\s\S]*?)--> that can be triggered by the below PoC:

from util import page_parse

pp = page_parse.main("-<!-" * 10000 + "\x00")

res = pp.get_links

How to repair

The cause of this vulnerability is the use of the backtracking-kind regex engine. I recommend the author to use the RE2 regex engine developed by google, but it doesn't support lookaround and backreference extension features, so we need to change the original regex to lookaround-free regex <!--([\s\S]*?)-->.

The second repair strategy is to remove lookaround from the regular expression and add corresponding code constraints:

import re2

def safe_replace(str, replacer):
    pattern = re2.compile("([\s\S]*?)-->")
    
    ranges = []
    iter = pattern.finditer(str)
    for match in iter:
        group = match.group(1)
        begin, end = match.span()
        if group.startswith("<!--"):
            ranges.append(match.span())

    res = ""
    prev = 0
    for range in ranges:
        begin, end = range
        if res == "":
            res += str[:begin] + replacer
            prev = end
        else:
            res += str[prev:begin] + replacer
            prev = end
    return res