Skip to content

[BUG] Regex evaluators catastrophic backtracking #6279

@Abhijoy-Mandal

Description

@Abhijoy-Mandal

Describe the bug
Regex evaluator used is susceptible to exponential backtracking attacks. This can be mitigated by using a non-backtracking evaluator like re2 https://github.com/google/re2j.

To Reproduce
Steps to reproduce the behavior:

  • Go to DropEventsProcessorIT
  • Create an adversarial case in the test cases
    • Replace the value in my_key to "a".repeat(256*1024) + "b"
    • Change the drop_when condition in drop_when_value_is_empty_string.yaml to /my_key =~ "(a+)+".
  • Build the drop_events plugin ./gradlew build -p /path/to/workspace/data-prepper/data-prepper-plugins/drop-events-processor
  • The tests never finish running.

Expected behavior
Regex evaluation should complete.

Screenshots
If applicable, add screenshots to help explain your problem.

Environment (please complete the following information):

  • OS: MacOS
  • Version [e.g. 22]

Additional context
Some things to consider:

  • This is an issue only when a service uses data-prepper as a service-side application and accepts inputs/configurations from potentially untrusworthy sources.
  • Re2J has some limitations in features in exchange for the linear time complexity guarantee, biggest one being that backreferencing is not supported.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Priority-Highbreaking changeAny change which may break existing configurations and deploymentsbugSomething isn't working

    Type

    No type

    Projects

    Status

    Unplanned

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions