-
-
Notifications
You must be signed in to change notification settings - Fork 211
Fix validate-iri hanging on malformed percent-encoding #2175
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix validate-iri hanging on malformed percent-encoding #2175
Conversation
- Add check for malformed percent-encoding sequences before calling validate-iri - Replace %prettyVersion% placeholders with actual versions in composer.lock - Prevents cdxgen from hanging when processing BookStack and similar PHP projects The validate-iri library hangs indefinitely on URLs with invalid percent-encoding like %prettyVersion% where %pr is not a valid hex sequence. This fix detects such malformed sequences early and also replaces known placeholders with actual version strings. Fixes issue with packages from Codeberg that use URL placeholders. Signed-off-by: Stefan Streichsbier <stefan@streichsbier.at>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you. This is the second ReDoS reported against that library. Might require some fuzzing to identify all problematic payloads in the future.
Could you kindly run pnpm lint command. |
Signed-off-by: Stefan Streichsbier <stefan@streichsbier.at>
Done, @prabhu. The library may be problematic as it hasn't been updated in three years. At least for now, the early percent-encoding check makes cdxgen more robust against these edge cases. |
Agreed. We may have to fork or contribute to this library and enhance its tests including adding fuzzing. Happy to recommend this project to the next round of GitHub SOSF as well. |
Sounds good! |
Thank you so much! |
I found numerous other payloads that is causing the library to hang. Working on a separate PR.
|
Raised #2180 |
Changelog:
The validate-iri library hangs indefinitely on URLs with invalid percent-encoding like %prettyVersion% where %pr is not a valid hex sequence. This fix detects such malformed sequences early and also replaces known placeholders with actual version strings.
Fixes issue with packages from Codeberg that use URL placeholders.
See issue #2174