:lock: fix: CVE-2023-26115 by aashutoshrathi · Pull Request #33 · jonschlinkert/word-wrap (original) (raw)

Merged

doowb

merged 2 commits into

Jul 18, 2023

Conversation

Fixes #32

Issue with existing approach

CVE-2023-26115
TLDR; ReDoS, the issue is due to Regex matching algo.

Approach used here

Removed the use of String.prototype.replace(Regex), instead wrote function to trim tabs and space from the end of line.

Benchmarks

Code snippet used

const wrap = require("word-wrap");

for (let i = 0; i <= 10; i++) { const attack = "a" + "t".repeat(i * 10_00000); const start = performance.now(); attack.replace(/[ \t]*$/gm, ''); // -> since this is happening inside code. // wrap(attack, { trim: true }); console.log(wrap.trim: <math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><mrow><mi>a</mi><mi>t</mi><mi>t</mi><mi>a</mi><mi>c</mi><mi>k</mi><mi mathvariant="normal">.</mi><mi>l</mi><mi>e</mi><mi>n</mi><mi>g</mi><mi>t</mi><mi>h</mi></mrow><mi>c</mi><mi>h</mi><mi>a</mi><mi>r</mi><mi>a</mi><mi>c</mi><mi>t</mi><mi>e</mi><mi>r</mi><mi>s</mi><mo>:</mo></mrow><annotation encoding="application/x-tex">{attack.length} characters: </annotation></semantics></math>attack.lengthcharacters:{performance.now() - start}ms); }

for (i = 0; i <= 10; i++) { const attack = "a" + "t".repeat(i * 10_00000); const start2 = performance.now(); trimTabAndSpaces(attack); console.log(trimTabAndSpaces: <math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><mrow><mi>a</mi><mi>t</mi><mi>t</mi><mi>a</mi><mi>c</mi><mi>k</mi><mi mathvariant="normal">.</mi><mi>l</mi><mi>e</mi><mi>n</mi><mi>g</mi><mi>t</mi><mi>h</mi></mrow><mi>c</mi><mi>h</mi><mi>a</mi><mi>r</mi><mi>a</mi><mi>c</mi><mi>t</mi><mi>e</mi><mi>r</mi><mi>s</mi><mo>:</mo></mrow><annotation encoding="application/x-tex">{attack.length} characters: </annotation></semantics></math>attack.lengthcharacters:{performance.now() - start2}ms); }

Performance Benchmarks

node test.js wrap.trim: 1 characters: 0.015165984630584717ms wrap.trim: 1000001 characters: 6.47087499499321ms wrap.trim: 2000001 characters: 13.000333994626999ms wrap.trim: 3000001 characters: 19.574499994516373ms wrap.trim: 4000001 characters: 26.035459011793137ms wrap.trim: 5000001 characters: 31.902458995580673ms wrap.trim: 6000001 characters: 38.429375022649765ms wrap.trim: 7000001 characters: 44.44049999117851ms wrap.trim: 8000001 characters: 51.241291999816895ms wrap.trim: 9000001 characters: 57.14437499642372ms wrap.trim: 10000001 characters: 63.937458992004395ms

trimTabAndSpaces: 1 characters: 0.3221670091152191ms trimTabAndSpaces: 1000001 characters: 0.2049579918384552ms trimTabAndSpaces: 2000001 characters: 0.3135409951210022ms trimTabAndSpaces: 3000001 characters: 0.3718339800834656ms trimTabAndSpaces: 4000001 characters: 0.7508749961853027ms trimTabAndSpaces: 5000001 characters: 0.6123340129852295ms trimTabAndSpaces: 6000001 characters: 0.7714170217514038ms trimTabAndSpaces: 7000001 characters: 1.168584018945694ms trimTabAndSpaces: 8000001 characters: 0.9755829870700836ms trimTabAndSpaces: 9000001 characters: 1.406792014837265ms trimTabAndSpaces: 10000001 characters: 1.5417499840259552ms

htbkoo, OGC-Zang, TooTallNate, LeoniePhiline, bennycode, alfaproject, bryan-hoang, pimterry, davidcalhoun, SchroederSteffen, and 9 more reacted with thumbs up emoji Altair200333, sfc-gh-dszmolka, jackkoppa, am-maneaters, nergal, MateuszKikmunter, Greg-Smulko, swellander, Luen, wellwelwel, and 13 more reacted with heart emoji