fix: Potential ReDoS Vulnerability or Inefficient Regular Expression in Project: Need for Assessment and Mitigation

[mmmsssttt404]

What kind of change does this PR introduce? (check at least one)

• Bugfix
• Feature
• Code style update
• Refactor
• Docs
• Underlying tools
• Other, please describe:

Does this PR introduce a breaking change? (check one)

• Yes
• No

Other information:

I am writing to report a potential Regular Expression Denial of Service (ReDoS) vulnerability or Inefficient Regular Expression in the project. When using specially crafted input strings in the context, it may lead to extremely high CPU usage, application freezing, or denial of service attacks.

https://github.com/mmmsssttt404/vue-cli/blob/d7eb1fdfff4f71f9d7ef7a20a88f42ca582ebfca/packages/%40vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js#L67

Describe the steps to verify that the changes are working as expected.

1.git clone https://github.com/mmmsssttt404/vue-cli.git
2.yarn
3.yarn test pwa

changes:

<link rel="icon"(?!<link rel="icon")[^>]+>

test('ReDos test', async () => {
  HtmlWebpackPlugin.getHooks = () => ({
    beforeEmit: {
      tapAsync: (id, handler) => {
        const hugeHtml = '<link rel="icon"'.repeat(100000) + '\u0000';
        const data = { html: hugeHtml };
        handler(data, (err, result) => {
        });
      }
    },
    alterAssetTagGroups: { 
      tapAsync: () => {}
    }
  });
  const plugin = new HtmlPwaPlugin()
  const fakeCompiler = {
    options: { output: { publicPath: '/' } },
    hooks: {
      compilation: {
        tap: (_id, cb) => {
          const fakeCompilation = {
            hooks: {
              processAssets: {
                tap: (_opts, fn) => {
                }
              }
            }
          }
          cb(fakeCompilation)
        }
      }
    }
  }
  const startTime = performance.now()
  plugin.apply(fakeCompiler)
  const endTime = performance.now()
  const timeTaken = endTime - startTime
  console.log(` time taken: ${timeTaken.toFixed(3)} ms`)
  expect(timeTaken).toBeLessThan(3000)
}, 3000)

before:

after:

[haoqunjiang]

Thanks for the PR. But I don’t think it qualifies as a vulnerability. For this project’s use case, plugin users supply the HTML for transformation to the plugin. They fully control the input. Therefore, an inefficient regex cannot be exploited to cause a ReDoS attack.