fix: Escape special characters in regex pattern

[odaysec]

lighthouse-ci/packages/cli/src/collect/collect.js

Line 162 in ebee453

const regexPattern = new RegExp(options.startServerReadyPattern, 'i');

Constructing a regular expression with unsanitized user input is dangerous as a malicious user may be able to modify the meaning of the expression. In particular, such a user may be able to provide a regular expression fragment that takes exponential time in the worst case, and use that to perform a Denial of Service attack.

General approach: Avoid constructing a RegExp directly from unsanitized user input or, if regular expressions must be user‑supplied, validate or constrain them to prevent pathological behavior. Common options are: escaping meta‑characters (turning input into a literal pattern), whitelisting simple allowed constructs, or rejecting patterns that exceed size/complexity limits.

Best fix here without changing intended functionality too much:

• startServerReadyPattern is meant to be “a pattern the server prints when it is ready.” In practice, users usually specify a literal string like Listening on 8080. Treating this as a literal substring search is sufficient and simpler than exposing full regex power.
• We can still use RegExp, but we should escape all regex metacharacters in the user input so it’s interpreted literally. This preserves user expectations for simple patterns and removes the ability to inject complex or catastrophic regexes.
• Implement a small helper function escapeRegExp in collect.js (rather than adding new dependencies) and apply it to options.startServerReadyPattern before constructing the RegExp.

Concretely:

1. In packages/cli/src/collect/collect.js, define a local escapeRegExp utility near the top of the file.

2. In startServerAndDetermineUrls, replace the line:

   const regexPattern = new RegExp(options.startServerReadyPattern, 'i');

   with:

   const safePattern = escapeRegExp(String(options.startServerReadyPattern || ''));
   const regexPattern = new RegExp(safePattern, 'i');

   This:

   • Coerces the value to string and safely handles undefined/null.
   • Escapes all regex metacharacters, preventing injection.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.