• Nick Thomas's avatar
    Fix denial-of-service attack in Markdown parser · 13157870
    Nick Thomas authored
    Given a markdown link like:
    
    ```md
    [foo](foo bar.jpg)
    ```
    
    Commonmark parsers will not recognise it as a link, because of the
    space. To solve this, we have a Banzai filter that uses a regular
    expression to detect the unparsed link and rewrite it into a parseable
    one, replacing the space with '%20'. However, the use of backtracking
    in the regular expression makes it vulnerable to complex inputs.
    
    Switching to Gitlab::UntrustedRegexp lets us guarantee that the regular
    expression will always complete in linear time, solving the resource
    use issue.
    
    Changelog: security
    13157870
string_regex_marker_spec.rb 1.61 KB