Skip to content

Commit f5bfed6

Browse files
committed
Strikethrough: fix exponential backtracking
A long sequence of backslashes inside a strikethrough could confuse the strikethrough regex into exponential backtracking, causing a potential ReDoS vulnerability. This commit updates the strikethrough regex to only accept a backslash if it is preceding an escaped character, as other rules handle backslashes. Updates to version 0.7.3 to publish this fix. Thanks to @pwntester and the [GitHub Security Lab team](https://securitylab.github.com/) for finding this vulnerability! Test plan: 1. `make test` * verify the new strikethrough backtracking test passes * verify all the prior tests pass
1 parent d3780d4 commit f5bfed6

File tree

6 files changed

+15
-5
lines changed

6 files changed

+15
-5
lines changed

__tests__/simple-markdown-test.js

+10
Original file line numberDiff line numberDiff line change
@@ -4414,5 +4414,15 @@ describe("simple markdown", function() {
44144414
var duration = Date.now() - startTime;
44154415
assert.ok(duration < 10, "Expected parsing to finish in <10ms, but was " + duration + "ms.");
44164416
});
4417+
4418+
it("should parse long strikethroughs with lots of backslasher quickly", function() {
4419+
var source = "~~\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}\\}" +
4420+
"\\}\\}\\}\\}\\}\\}\\}\\}\\\\}\\}\\}\\}\\}\\}\\}}\\}\\}\\}\\}\\}\\}}~";
4421+
4422+
var startTime = Date.now();
4423+
var parsed = blockParse(source);
4424+
var duration = Date.now() - startTime;
4425+
assert.ok(duration < 10, "Expected parsing to finish in <10ms, but was " + duration + "ms.");
4426+
});
44174427
});
44184428
});

package-lock.json

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "simple-markdown",
3-
"version": "0.7.2",
3+
"version": "0.7.3",
44
"description": "Javascript markdown parsing, made simple",
55
"main": "simple-markdown.js",
66
"types": "simple-markdown.d.ts",

simple-markdown.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1700,7 +1700,7 @@ var defaultRules /* : DefaultRules */ = {
17001700
},
17011701
del: {
17021702
order: currOrder++,
1703-
match: inlineRegex(/^~~(?=\S)((?:\\[\s\S]|~(?!~)|[^\s~]|\s(?!~~))+?)~~/),
1703+
match: inlineRegex(/^~~(?=\S)((?:\\[\s\S]|~(?!~)|[^\s~\\]|\s(?!~~))+?)~~/),
17041704
parse: parseCaptureInline,
17051705
react: function(node, output, state) {
17061706
return reactElement(

simple-markdown.min.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/index.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1698,7 +1698,7 @@ var defaultRules /* : DefaultRules */ = {
16981698
},
16991699
del: {
17001700
order: currOrder++,
1701-
match: inlineRegex(/^~~(?=\S)((?:\\[\s\S]|~(?!~)|[^\s~]|\s(?!~~))+?)~~/),
1701+
match: inlineRegex(/^~~(?=\S)((?:\\[\s\S]|~(?!~)|[^\s~\\]|\s(?!~~))+?)~~/),
17021702
parse: parseCaptureInline,
17031703
react: function(node, output, state) {
17041704
return reactElement(

0 commit comments

Comments
 (0)