rapid7 / recog

Pattern recognition for hosts, services, and content
Other
671 stars 199 forks source link

New anti-DoS patterns break Go regexp support with: invalid repeat count: `{0,1024}` #370

Closed hdm closed 3 years ago

hdm commented 3 years ago

Describe the bug

The recent change to use {0,maxLength} prefixes broke Recog use under Go since 1024 is above the maximum limit of 1000.

To Reproduce

This Go code reproduces the problem with the new fingerprints:

package main

import (
        "regexp"
)

func main() {
        regexp.MustCompile(`^\s{0,1024}APC FTP server ready\.$`)
}
$ go run main.go
panic: regexp: Compile(`^\s{0,1024}APC FTP server ready\.$`): error parsing regexp: invalid repeat count: `{0,1024}`

goroutine 1 [running]:
regexp.MustCompile(0x781970, 0x22, 0xc0000200b8)
        C:/Program Files/Go/src/regexp/regexp.go:311 +0x15f
main.main()
        C:/Users/Developer/go/recog-go/r/t.go:8 +0x3d
exit status 2

To fix the issue, change 0,1024 instances to 0,1000

tsellers-r7 commented 3 years ago

@hdm - This is fixed now. Thanks for bringing this up, sorry that it happened in the first place. We hope to have guardrails in place soonish that will prevent this from happening.

hdm commented 3 years ago

thanks!