Closed mbutsykin closed 2 years ago
Thanks for the fixes. I'll add your name to the list of contributors, and I will issue a new version of the lib this afternoon.
Thanks for fast feedback!
By the way, I suspected that there could be a ReDoS vulnerability due to your change on the regex _commentMode
, and it appears to be the case. If you try to parse the following PGN:
[Event "ReDoS using comment"]
1. e4 {Evil unterminated comment with lots of backslashes \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
... you'll see that it takes several seconds (and in fact the runtime doubles with each new backslash). I've fixed that in https://github.com/yo35/kokopu/commit/ce236369a636bb10a731ff7a0d4dfad2a11b8409
Regular expressions are sneaky guys! ;-)
Wow. nice catch) good job!
0
. Looks like old chessbase (<12) in some cases can put0.
as a move number after board setup...