NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
49.06k stars 5.65k forks source link

Unvalidated ExtensionPoint.manifest entries #6671

Open astrelsky opened 4 days ago

astrelsky commented 4 days ago

Describe the bug The entries in an ExtensionPoint.manifest file are not validated before being added to the buffer that is passed to Pattern.compile. Entries containing problematic regex characters such as \, (, [, etc. will cause unexpected behavior while searching for extension points or may cause Ghidra to throw an exception on startup.

To Reproduce Steps to reproduce the behavior:

  1. Open an existing extensions ExtensionPoint.manifest file and add Invalid.Cl\a(s[s.
  2. Attempt to start Ghidra and see "AssertException - Unable to locate extension points!"

Expected behavior Entries containing invalid characters should be logged and skipped.

Environment (please complete the following information):

Additional context I like breaking things