fix: escape input.id before regex construction to prevent ReDoS#9370
Open
karan68 wants to merge 1 commit intomicrosoft:mainfrom
Open
fix: escape input.id before regex construction to prevent ReDoS#9370karan68 wants to merge 1 commit intomicrosoft:mainfrom
karan68 wants to merge 1 commit intomicrosoft:mainfrom
Conversation
…ions.getReferencedInputs
Escape regex metacharacters in input.id before injecting it into a RegExp
constructor in shared.ts. Without escaping, a crafted input.id like '(a+)+'
causes catastrophic backtracking (ReDoS) when matched against URL templates
containing near-match patterns.
Affected code path: Action.Http -> StringWithSubstitutions.getReferencedInputs()
Standard actions (Submit, Execute, OpenUrl) are NOT affected as they use
different code paths that don't call this method.
Verified:
- Normal input IDs still match correctly (e.g. 'userName' matches {{userName.value}})
- Malicious IDs neutralized (0ms vs 13,350ms with 28 chars)
- All 28 existing jest tests pass
- TypeScript compilation and webpack build succeed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Escape regex metacharacters in
input.idbefore injecting it into aRegExpconstructor inStringWithSubstitutions.getReferencedInputs()(shared.ts line 87).Problem
input.idfrom untrusted card JSON is concatenated directly intonew RegExp()without escaping. A craftedidlike(a+)+causes catastrophic backtracking when the regex is executed against URL templates containing near-match patterns.Affected code path:
HttpAction.internalGetReferencedInputs()->StringWithSubstitutions.getReferencedInputs()Standard actions (Action.Submit, Action.Execute, Action.OpenUrl) use different code paths and are NOT affected.
Fix
Added
escapeRegExp() inline to sanitizeinput.idbefore regex construction. This escapes all regex metacharacters:. * + ? ^ $ { } ( ) | [ ] \Verification
Reproduction
Parse a card with
"id": "(a+)+"on an Input element and"type": "Action.Http"with URL {{aaa...28 chars...XXXXX}}, then click the action button. Browser freezes for 13+ seconds without this fix.