zinduolis
commented
3 weeks ago Hey @stephenakq , I have hardened the regex.
This is what Claude has to say about it with regard to vulnerabilities:
- ReDoS Risk: Low
^(0|[1-9][0-9]{0,3})(\.(0|[1-9][0-9]{0,3})){0,3}$
Properties that make it safe:
- Uses fixed-width ranges with
{0,3} - No nested quantifiers or alternations that could cause backtracking ambiguity
- No unbounded repetition (
*or+) - Clear, unambiguous pattern boundaries with fixed repeater
{0,3}
-
Time Complexity: O(n)
- Linear-time matching
- Each character is processed exactly once
- No backtracking scenarios that could cause exponential time growth
-
Memory & Input Size: Maximum possible input:
- First number: 4 digits (9999)
- Up to 3 additional segments: each 4 digits
- Dots between segments
- Total max: 4 + (3 × (1 + 4)) = 19 characters
-
Test with pathological inputs:
"9999.9999.9999.9999" // Maximum valid - processes quickly "9999.9999.9999.9999X" // Invalid char - fails fast "9999.9999.9999.9999.1" // Extra segment - fails fast ".........." // Invalid format - fails fast "a".repeat(1000) // Long invalid - fails immediately -
Edge Cases Handled:
- Prevents leading zeros in each number segment
- Clear start/end boundaries with
^and$ - Explicit handling of zero vs non-zero starts
Assessment: This is a well-designed, safe regex pattern. It avoids common regex vulnerabilities through:
- Bounded repetition
- No ambiguous patterns
- No catastrophic backtracking possibilities
- Natural input length limitations
This reverts commit 074efc7de6b6901e2c94df8e2c11f9690e424418 that reverted the merge of https://github.com/beefproject/beef/pull/3149
Pull Request
Thanks for submitting a PR! Please fill in this template where appropriate:
Category
Bug
Feature/Issue Description
Q: Please give a brief summary of your feature/fix A: Fix invalid browser version and plugins messages (#3051)
Q: Give a technical rundown of what you have changed (if applicable) A: Updated conditions checking for valid browser version. Also added message for situation when plugins are not detected (e. g. for mobile browsers). Added https://github.com/bowser-js/bowser and extended Chrome, Firefox and Opera browser name recognition.
Test Cases
Q: Describe your test cases, what you have covered and if there are any use cases that still need addressing. A: Successfully ran bundle exec rake, had print_info in the browser.rb file to confirm the values when hooking Firefox, Chrome, Opera and Android Chrome. Also, executed all the debug modules with these 3 browser types without any errors on beef side.
Wiki Page
If you are adding a new feature that is not easily understood without context, please draft a section to be added to the Wiki below.