mirror of
https://github.com/zulip/zulip.git
synced 2025-11-03 21:43:21 +00:00
e2d303c1bb
Zulip attempts to validate that the regular expressions that admins enter for linkifiers are well-formatted, and only contain a specific subset of regex grammar. The process of checking these properties (via a regex!) can cause denial-of-service via backtracking. Furthermore, this validation itself does not prevent the creation of linkifiers which themselves cause denial-of-service when they are executed. As the validator accepts literally anything inside of a `(?P<word>...)` block, any quadratic backtracking expression can be hidden therein. Switch user-provided linkifier patterns to be matched in the Markdown processor by the `re2` library, which is guaranteed constant-time. This somewhat limits the possible features of the regular expression (notably, look-head and -behind, and back-references); however, these features had never been advertised as working in the context of linkifiers. A migration removes any existing linkifiers which would not function under re2, after printing them for posterity during the upgrade; they are unlikely to be common, and are impossible to fix automatically. The denial-of-service in the linkifier validator was discovered by @erik-krogh and @yoff, as GHSL-2021-118.
168 lines
7.5 KiB
Python
168 lines
7.5 KiB
Python
import re
|
|
|
|
from zerver.lib.test_classes import ZulipTestCase
|
|
from zerver.models import RealmFilter
|
|
|
|
|
|
class RealmFilterTest(ZulipTestCase):
|
|
def test_list(self) -> None:
|
|
self.login("iago")
|
|
data = {
|
|
"pattern": "#(?P<id>[123])",
|
|
"url_format_string": "https://realm.com/my_realm_filter/%(id)s",
|
|
}
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
|
|
result = self.client_get("/json/realm/linkifiers")
|
|
self.assert_json_success(result)
|
|
linkifiers = result.json()["linkifiers"]
|
|
self.assertEqual(len(linkifiers), 1)
|
|
self.assertEqual(linkifiers[0]["pattern"], "#(?P<id>[123])")
|
|
self.assertEqual(linkifiers[0]["url_format"], "https://realm.com/my_realm_filter/%(id)s")
|
|
|
|
def test_create(self) -> None:
|
|
self.login("iago")
|
|
data = {"pattern": "", "url_format_string": "https://realm.com/my_realm_filter/%(id)s"}
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_error(result, "This field cannot be blank.")
|
|
|
|
data["pattern"] = "(foo"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_error(result, "Bad regular expression: missing ): (foo")
|
|
|
|
data["pattern"] = r"ZUL-(?P<id>\d????)"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_error(result, "Bad regular expression: bad repetition operator: ????")
|
|
|
|
data["pattern"] = r"ZUL-(?P<id>\d+)"
|
|
data["url_format_string"] = "$fgfg"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_error(result, "Enter a valid URL.")
|
|
|
|
data["pattern"] = r"ZUL-(?P<id>\d+)"
|
|
data["url_format_string"] = "https://realm.com/my_realm_filter/"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_error(result, "Invalid URL format string.")
|
|
|
|
data["url_format_string"] = "https://realm.com/my_realm_filter/#hashtag/%(id)s"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
self.assertIsNotNone(re.match(data["pattern"], "ZUL-15"))
|
|
|
|
data["pattern"] = r"ZUL2-(?P<id>\d+)"
|
|
data["url_format_string"] = "https://realm.com/my_realm_filter/?value=%(id)s"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
self.assertIsNotNone(re.match(data["pattern"], "ZUL2-15"))
|
|
|
|
data["pattern"] = r"_code=(?P<id>[0-9a-zA-Z]+)"
|
|
data["url_format_string"] = "https://example.com/product/%(id)s/details"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
self.assertIsNotNone(re.match(data["pattern"], "_code=123abcdZ"))
|
|
|
|
data["pattern"] = r"PR (?P<id>[0-9]+)"
|
|
data[
|
|
"url_format_string"
|
|
] = "https://example.com/~user/web#view_type=type&model=model&action=12345&id=%(id)s"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
self.assertIsNotNone(re.match(data["pattern"], "PR 123"))
|
|
|
|
data["pattern"] = r"lp/(?P<id>[0-9]+)"
|
|
data["url_format_string"] = "https://realm.com/my_realm_filter/?value=%(id)s&sort=reverse"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
self.assertIsNotNone(re.match(data["pattern"], "lp/123"))
|
|
|
|
data["pattern"] = r"lp:(?P<id>[0-9]+)"
|
|
data["url_format_string"] = "https://realm.com/my_realm_filter/?sort=reverse&value=%(id)s"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
self.assertIsNotNone(re.match(data["pattern"], "lp:123"))
|
|
|
|
data["pattern"] = r"!(?P<id>[0-9]+)"
|
|
data[
|
|
"url_format_string"
|
|
] = "https://realm.com/index.pl?Action=AgentTicketZoom;TicketNumber=%(id)s"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
self.assertIsNotNone(re.match(data["pattern"], "!123"))
|
|
|
|
data["pattern"] = r"(?P<org>[a-zA-Z0-9_-]+)/(?P<repo>[a-zA-Z0-9_-]+)#(?P<id>[0-9]+)"
|
|
data["url_format_string"] = "https://github.com/%(org)s/%(repo)s/issue/%(id)s"
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
self.assertIsNotNone(re.match(data["pattern"], "zulip/zulip#123"))
|
|
|
|
def test_not_realm_admin(self) -> None:
|
|
self.login("hamlet")
|
|
result = self.client_post("/json/realm/filters")
|
|
self.assert_json_error(result, "Must be an organization administrator")
|
|
result = self.client_delete("/json/realm/filters/15")
|
|
self.assert_json_error(result, "Must be an organization administrator")
|
|
|
|
def test_delete(self) -> None:
|
|
self.login("iago")
|
|
data = {
|
|
"pattern": "#(?P<id>[123])",
|
|
"url_format_string": "https://realm.com/my_realm_filter/%(id)s",
|
|
}
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
|
|
linkifier_id = result.json()["id"]
|
|
linkifiers_count = RealmFilter.objects.count()
|
|
result = self.client_delete(f"/json/realm/filters/{linkifier_id + 1}")
|
|
self.assert_json_error(result, "Linkifier not found.")
|
|
|
|
result = self.client_delete(f"/json/realm/filters/{linkifier_id}")
|
|
self.assert_json_success(result)
|
|
self.assertEqual(RealmFilter.objects.count(), linkifiers_count - 1)
|
|
|
|
def test_update(self) -> None:
|
|
self.login("iago")
|
|
data = {
|
|
"pattern": "#(?P<id>[123])",
|
|
"url_format_string": "https://realm.com/my_realm_filter/%(id)s",
|
|
}
|
|
result = self.client_post("/json/realm/filters", info=data)
|
|
self.assert_json_success(result)
|
|
|
|
linkifier_id = result.json()["id"]
|
|
data = {
|
|
"pattern": "#(?P<id>[0-9]+)",
|
|
"url_format_string": "https://realm.com/my_realm_filter/issues/%(id)s",
|
|
}
|
|
result = self.client_patch(f"/json/realm/filters/{linkifier_id}", info=data)
|
|
self.assert_json_success(result)
|
|
self.assertIsNotNone(re.match(data["pattern"], "#1234"))
|
|
|
|
# Verify that the linkifier is updated accordingly.
|
|
result = self.client_get("/json/realm/linkifiers")
|
|
self.assert_json_success(result)
|
|
linkifier = result.json()["linkifiers"]
|
|
self.assertEqual(len(linkifier), 1)
|
|
self.assertEqual(linkifier[0]["pattern"], "#(?P<id>[0-9]+)")
|
|
self.assertEqual(
|
|
linkifier[0]["url_format"], "https://realm.com/my_realm_filter/issues/%(id)s"
|
|
)
|
|
|
|
data = {
|
|
"pattern": r"ZUL-(?P<id>\d????)",
|
|
"url_format_string": "https://realm.com/my_realm_filter/%(id)s",
|
|
}
|
|
result = self.client_patch(f"/json/realm/filters/{linkifier_id}", info=data)
|
|
self.assert_json_error(result, "Bad regular expression: bad repetition operator: ????")
|
|
|
|
data["pattern"] = r"ZUL-(?P<id>\d+)"
|
|
data["url_format_string"] = "$fgfg"
|
|
result = self.client_patch(f"/json/realm/filters/{linkifier_id}", info=data)
|
|
self.assert_json_error(result, "Enter a valid URL.")
|
|
|
|
data["pattern"] = r"#(?P<id>[123])"
|
|
data["url_format_string"] = "https://realm.com/my_realm_filter/%(id)s"
|
|
result = self.client_patch(f"/json/realm/filters/{linkifier_id + 1}", info=data)
|
|
self.assert_json_error(result, "Linkifier not found.")
|