Skip to content

Commit

Permalink
Strikethrough: fix exponential backtracking
Browse files Browse the repository at this point in the history
A long sequence of backslashes inside a strikethrough could confuse the
strikethrough regex into exponential backtracking, causing a potential
ReDoS vulnerability.

This commit updates the strikethrough regex to only accept a backslash
if it is preceding an escaped character, as other rules handle
backslashes.

Updates to version 0.7.3 to publish this fix.

Thanks to @pwntester and the [GitHub Security Lab team](https://securitylab.github.com/)
for finding this vulnerability!

Test plan:

1. `make test`
    * verify the new strikethrough backtracking test passes
    * verify all the prior tests pass
  • Loading branch information
ariabuckles committed Jan 8, 2021
1 parent d3780d4 commit f5bfed6
Show file tree
Hide file tree
Showing 6 changed files with 15 additions and 5 deletions.
10 changes: 10 additions & 0 deletions __tests__/simple-markdown-test.js
Original file line number Diff line number Diff line change
Expand Up @@ -4414,5 +4414,15 @@ describe("simple markdown", function() {
var duration = Date.now() - startTime;
assert.ok(duration < 10, "Expected parsing to finish in <10ms, but was " + duration + "ms.");
});

it("should parse long strikethroughs with lots of backslasher quickly", function() {
var source = "~~\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}" +
"\\}\\}\\}\\}\\}\\}\\}\\}\\\\}\\}\\}\\}\\}\\}\\}}\\}\\}\\}\\}\\}\\}}~";

var startTime = Date.now();
var parsed = blockParse(source);
var duration = Date.now() - startTime;
assert.ok(duration < 10, "Expected parsing to finish in <10ms, but was " + duration + "ms.");
});
});
});
2 changes: 1 addition & 1 deletion package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "simple-markdown",
"version": "0.7.2",
"version": "0.7.3",
"description": "Javascript markdown parsing, made simple",
"main": "simple-markdown.js",
"types": "simple-markdown.d.ts",
Expand Down
2 changes: 1 addition & 1 deletion simple-markdown.js
Original file line number Diff line number Diff line change
Expand Up @@ -1700,7 +1700,7 @@ var defaultRules /* : DefaultRules */ = {
},
del: {
order: currOrder++,
match: inlineRegex(/^~~(?=\S)((?:\\[\s\S]|~(?!~)|[^\s~]|\s(?!~~))+?)~~/),
match: inlineRegex(/^~~(?=\S)((?:\\[\s\S]|~(?!~)|[^\s~\\]|\s(?!~~))+?)~~/),
parse: parseCaptureInline,
react: function(node, output, state) {
return reactElement(
Expand Down
2 changes: 1 addition & 1 deletion simple-markdown.min.js

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion src/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -1698,7 +1698,7 @@ var defaultRules /* : DefaultRules */ = {
},
del: {
order: currOrder++,
match: inlineRegex(/^~~(?=\S)((?:\\[\s\S]|~(?!~)|[^\s~]|\s(?!~~))+?)~~/),
match: inlineRegex(/^~~(?=\S)((?:\\[\s\S]|~(?!~)|[^\s~\\]|\s(?!~~))+?)~~/),
parse: parseCaptureInline,
react: function(node, output, state) {
return reactElement(
Expand Down

0 comments on commit f5bfed6

Please sign in to comment.