search

ecto / bleach

:no_entry_sign: minimalistic HTML sanitizer for node.js
119 stars 21 forks source link

Take a look #12

Open wilbertcr opened 8 years ago

wilbertcr commented 8 years ago

[https://srcclr.com/bleach/javascript/npm/c-12769/vulnerabilities]

markstos commented 8 years ago

The link says there is a low-risk denial of service issue with this module related to regular expressions. A more specific link is here:

https://srcclr.com/security/regular-expression-denial-service-redos-/javascript/sid-1862/technical

Version 0.3.0, the current version, is listed as being vulnerable.

The problematic line pointed to is this one: https://github.com/ecto/bleach/blob/master/lib/bleach.js#L73

A related reference is here: https://nodesecurity.io/advisories/47

More about RegEx-based DOS: https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS

wusala01 commented 5 years ago

A potential workaround could be this, couldn't it?

Iam not very experienced with Regex-based DOS, but might this help?

      html = html.replace(/<script(?:.*?)>(?:.|[\r\n])*?<\/script(?:.*)>/gmi, '');

vs. 

      html = html.replace(/<script(.*?)>(.*?[\r\n])*?(.*?)(.*?[\r\n])*?<\/script>/gim, '');

Quantified group with a quantifier in it thingy is gone.