mirror of
https://github.com/zulip/zulip.git
synced 2025-10-23 04:52:12 +00:00
e2d303c1bb
Zulip attempts to validate that the regular expressions that admins enter for linkifiers are well-formatted, and only contain a specific subset of regex grammar. The process of checking these properties (via a regex!) can cause denial-of-service via backtracking. Furthermore, this validation itself does not prevent the creation of linkifiers which themselves cause denial-of-service when they are executed. As the validator accepts literally anything inside of a `(?P<word>...)` block, any quadratic backtracking expression can be hidden therein. Switch user-provided linkifier patterns to be matched in the Markdown processor by the `re2` library, which is guaranteed constant-time. This somewhat limits the possible features of the regular expression (notably, look-head and -behind, and back-references); however, these features had never been advertised as working in the context of linkifiers. A migration removes any existing linkifiers which would not function under re2, after printing them for posterity during the upgrade; they are unlikely to be common, and are impossible to fix automatically. The denial-of-service in the linkifier validator was discovered by @erik-krogh and @yoff, as GHSL-2021-118.
40 lines
1.2 KiB
Python
40 lines
1.2 KiB
Python
import re2
|
|
from django.db import migrations
|
|
from django.db.backends.postgresql.schema import DatabaseSchemaEditor
|
|
from django.db.migrations.state import StateApps
|
|
|
|
|
|
def delete_re2_invalid(apps: StateApps, schema_editor: DatabaseSchemaEditor) -> None:
|
|
options = re2.Options()
|
|
options.log_errors = False
|
|
|
|
RealmFilter = apps.get_model("zerver", "RealmFilter")
|
|
found_errors = False
|
|
for linkifier in RealmFilter.objects.all():
|
|
try:
|
|
re2.compile(linkifier.pattern, options=options)
|
|
except re2.error:
|
|
if not found_errors:
|
|
print()
|
|
found_errors = True
|
|
print(
|
|
f"Deleting linkifier {linkifier.id} in realm {linkifier.realm.string_id} which is not compatible with new re2 engine:"
|
|
)
|
|
print(f" {linkifier.pattern} -> {linkifier.url_format_string}")
|
|
linkifier.delete()
|
|
|
|
|
|
class Migration(migrations.Migration):
|
|
|
|
dependencies = [
|
|
("zerver", "0325_alter_realmplayground_unique_together"),
|
|
]
|
|
|
|
operations = [
|
|
migrations.RunPython(
|
|
delete_re2_invalid,
|
|
reverse_code=migrations.RunPython.noop,
|
|
elidable=True,
|
|
)
|
|
]
|