muellerberndt / sabre

Security analyzer for Solidity smart contracts. Uses the MythX smart contract security service.
https://mythx.io
MIT License
60 stars 23 forks source link

Error in regular expression #45

Closed sobolev-igor closed 5 years ago

sobolev-igor commented 5 years ago

When I try to scan my contracts I get the following error:

SyntaxError: Invalid regular expression: /(?<line>\d+):(?<col>\d+):(?<source>\d+)/: Invalid group

It raises in lib/helpers.js, line 131

So, I had to change this line into

const sourceMapRegex = /(\d+):(\d+):(\d+)/g;

My node version is v8.10.0

Moreover, there is one more problem: The numbers of lines are incorrect in my scan. I suppose it is because of multi-line comments and NatSpec comments (ones starting with /** ).

muellerberndt commented 5 years ago

Hey @sobolev-igor, can you share the contract you are analyzing?

sobolev-igor commented 5 years ago

I've just figured out that problem is in special symbols in contract's comments.

pragma solidity 0.5.7;

// 추가
//████████╗██████╗  ██████╗ ███╗

contract A {
    //this line triggers MythX pattern
    uint[] public data;
    uint data2;
    uint data3;
    uint data4;
    uint data5;
    uint data6;
    uint data7;
}

Removing first two comments fixes the second problem, but the first one still remains.

daniyarchambylov commented 5 years ago

@b-mueller I'm getting same error with MetaCoin. Sabre version sabre-mythx@0.4.5

blitz-1306 commented 5 years ago

@b-mueller this may be node.js version problem. I got this error on v8.11.4 too.

muellerberndt commented 5 years ago

Yes, looks like named capture groups were introduced only recently.

Should we simplify the regex for backwards compatibility?

blitz-1306 commented 5 years ago

@b-mueller as I see, two options are available:

It would be nice if regex can be simplified. If not, then second option should be considered.

muellerberndt commented 5 years ago

@blitz-1306 @sobolev-igor this should be fixed in latest master, can you please verify.

$  npm install git+https://github.com/b-mueller/sabre
sobolev-igor commented 5 years ago

@b-mueller works correctly on my computer, thanks!

however, special symbols still break line numbers (don't think it's important so much)

blitz-1306 commented 5 years ago

@b-mueller I'm confirming that regex crash no longer occurs - report is produced.