Artifact tag matcher: Curb complexity when parsing regexps from user input #3836
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit adds a limit to the lengrh of regular expressions we take from user input to set a length limit and curve the complexity Minder handles when compiling them. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
meganbruce
approved these changes
Jul 10, 2024
blkt
approved these changes
Jul 10, 2024
blkt
approved these changes
Jul 10, 2024
| @@ -47,6 +47,9 @@ func BuildFilter(tags []string, tagRegex string) (*filter, error) { | |||
|
|
|||
| // no tags specified, but a regex was, compile it | |||
| if tagRegex != "" { | |||
| if len(tagRegex) > 512 { | |||
| return nil, fmt.Errorf("tag regular expressions are limited to 512 characters") | |||
There was a problem hiding this comment.
suggestion (non-blocking): it could be useful to define this error statically so that upper layers can react accordingly, e.g. by returning a 400 or 409 in case this codepath is reachable from a handler.
There was a problem hiding this comment.
OK, makes sense. I'll surface it in a follow-up, thanks!
dmjb
pushed a commit
that referenced
this pull request
Jul 12, 2024
…input (#3836) * Mitigate ReDos in artifact tag matcher This commit adds a limit to the lengrh of regular expressions we take from user input to set a length limit and curve the complexity Minder handles when compiling them. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Add test for artifact.BuildFilter Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> --------- Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds a length limit to the regular expressions we parse from user input to curve the complexity Minder
handles when compiling them to build a tag matcher.
Change Type
Mark the type of change your PR introduces:
Testing
Outline how the changes were tested, including steps to reproduce and any relevant configurations.
Attach screenshots if helpful.
Review Checklist: