GhostManager / Ghostwriter

The SpecterOps project management and reporting engine
https://ghostwriter.wiki
BSD 3-Clause "New" or "Revised" License
1.23k stars 174 forks source link

Restrict regex for finding `{{.dot}}` tags to prevent ReDoS #454

Closed ColonelThirtyTwo closed 3 weeks ago

ColonelThirtyTwo commented 3 weeks ago

Prevents exponential backtracking in the regex with malicious input. No longer matches evidences with { or } in it, but those are unlikely and evidences with }} wouldn't work anyway. If needed, use mk_evidence("evidence_name") instead.