spamscanner / url-regex-safe

Regular expression matching for URL's. Maintained, safe, and browser-friendly version of url-regex. Resolves CVE-2020-7661 for Node.js servers.
https://forwardemail.net/docs/url-regex-javascript-node-js
MIT License
79 stars 16 forks source link

jest malloc errors #25

Closed katlim-br closed 2 years ago

katlim-br commented 2 years ago

When I import const urlRegexSafe = require("url-regex-safe");

and run jest --runInBand, the following error shows up:

node(30943,0x10a4d3600) malloc: *** error for object 0x600000590010: pointer being freed was not allocated
node(30943,0x10a4d3600) malloc: *** set a breakpoint in malloc_error_break to debug

And when running in github actions, it shows

Ran all test suites.
malloc_consolidate(): invalid chunk size
Aborted (core dumped)
error Command failed with exit code 134.

At first I thought it was jsdom, then I thought htmlparser2 or even parser5, but in the end was this library that seems to make the error.

Any thoughts why?

katlim-br commented 2 years ago

It seems it relates to the RE2 dependency. I tried url-regex and it passed ok.

katlim-br commented 2 years ago

Also, I tried to create a new package with that dependency only url-regex-safe, jest, yarn. And it didn't fail :(.

As background, we work in a monorepo, and we have around 170 tests (in 36 suites).

So, I give in the fact that it seems like the sum of many things (although we can't exactly identify them), but do note that when I comment out the code that references this library, the error goes away.

Any help would be appreciated.

niftylettuce commented 2 years ago

Do you have multiple re2 installations? See https://github.com/uhop/node-re2/issues/73.

katlim-br commented 2 years ago

I just found that issue some minutes ago, indeed we use two libraries email-forward-parser and url-regex-safe, both use re2.

We created this repo https://github.com/blastradius-ai/re2-malloc-error to start documenting it, and also to easily reproduce it.

Any ideas how to solve it?

niftylettuce commented 2 years ago

See v3.0.0 https://github.com/spamscanner/url-regex-safe/releases/tag/v3.0.0

katlim-br commented 2 years ago

it does solve the issue!!! big thanks!