🛡️ Sentinel: [CRITICAL] Fix ReDoS vulnerability in HTML parsing - #32
Conversation
🚨 Severity: CRITICAL 💡 Vulnerability: A Regular Expression Denial of Service (ReDoS) vulnerability was identified in `packages/github/src/index.ts` due to complex, greedy regular expressions used for HTML parsing. 🎯 Impact: Attackers could potentially stall or crash the application by supplying malformed HTML strings that trigger catastrophic backtracking in the regular expressions. Additionally, O(N^2) complexity logic caused further performance hits when evaluating large data sets. 🔧 Fix: Refactored `parseContributionCalendar` to use a safe two-pass parsing pattern and replaced O(N^2) deduplication array logic with `Map` for O(N) evaluation. Documented in `.jules/sentinel.md`. ✅ Verification: `bun test` passes successfully for packages/github, and `bun run test` + `bun run check` execute without error, ensuring regressions were not introduced.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e4ff7e3f4c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const daysMap = new Map<string, { date: string; level: number; count?: number }>(); | ||
|
|
||
| // First isolate td tags | ||
| const tdPattern = /<td[^>]+>/g; |
There was a problem hiding this comment.
If the fetched HTML is malformed or adversarial and contains many <td prefixes without a closing >, this unanchored pattern scans the remaining input from every prefix, so parsing remains O(N²) and can still stall the process—the denial-of-service behavior this change is intended to remove. Isolate tags with a single-pass parser or otherwise ensure each input character is examined only a bounded number of times.
Useful? React with 👍 / 👎.
…76812775106 Signed-off-by: Miccy <support@miccy.dev>
1 participant
🚨 Severity: CRITICAL
💡 Vulnerability: A Regular Expression Denial of Service (ReDoS) vulnerability was identified in
packages/github/src/index.tsdue to complex, greedy regular expressions used for HTML parsing.🎯 Impact: Attackers could potentially stall or crash the application by supplying malformed HTML strings that trigger catastrophic backtracking in the regular expressions. Additionally, O(N^2) complexity logic caused further performance hits when evaluating large data sets.
🔧 Fix: Refactored
parseContributionCalendarto use a safe two-pass parsing pattern and replaced O(N^2) deduplication array logic withMapfor O(N) evaluation. Documented in.jules/sentinel.md.✅ Verification:
bun testpasses successfully for packages/github, andbun run test+bun run checkexecute without error, ensuring regressions were not introduced.