Denial of Service in isEmail validator

[katanacrimson]

Not sure how reliable this is, but it doesn't appear that the author ever bothered to responsibly report the issue: http://lab.cs.ttu.ee/dl93 ( PDF Warning )

You'll want to check 2.4.2.1 of it where the author provides an example of a claimed Denial of Service vector against this module - not sure if it's applicable after the change to fix issue #109 (commit a643b4f) but I figured it should be addressed after seeing the paper pop up on reddit.

[ProZachJ]

The current version of validator is vulnerable to this attack. I have confirmed it and can provide an exploitable example.

I am currently using a friend of mines custom ReDOS tool to test all the regexs in this library for issues. Looks like isEmail is vulnerable as well.

[chriso]

@damianb the author's supervisor, Andres Ojamaa, contacted me privately about the issue and including the following proof of concept

v = require('validator');
s = '';
for (var i = 0; i < 100; i++) {
    s += '-/';
    t = Date.now();
    url = 'http://example.org/' + s + '@';
    try {
        v.check(url).isUrl();
    } catch (e) { }
    console.log('i = ' + i + ", len: " + url.length + ", time: " + (Date.now() - t) + " ms");
}

The denial of service attack that's described in the paper was fixed in a643b4f by replacing the RFC1738 regexp with another, however the replacement regular expression still features at least one repeated subexpression that includes a repeated pattern, i.e. it's probably still prone to a similar attack.

[chriso]

@ProZachJ no need to post an example. If the regex contains ([pattern]<repetition>)<repetition> then it's exploitable.

[evilpacket]

Any update on addressing this issue in an upcoming release?

[chriso]

@evilpacket not yet. What's required is a hand-written parser that doesn't use RegExp's (or at least not the evil patterns). The isURL RegExp is huge so this would require a lot of work.

[freewil]

Some of these regexes are overly-complicated. Multiline regexes are probably one of my favorite features of CoffeeScript, but the KISS principle probably applies here.

[AVVS]

Just stumbled upon a simple example that hangs the checker:
require("validator").isURL("http://www.iwasborn10thousandyearsago.bl...")

Takes several seconds to complete