Security Audit Report: Font Parsing, ReDoS, and Prototype Pollution Findings

[artahir-dev]

Description

I recently conducted a comprehensive security audit of Vercel Satori (satori <= 0.10.13) focusing on critical areas such as font handling, regular expression safety (ReDoS), and prototype pollution.

This issue serves to document the negative findings (tests confirmed as SAFE) and the methodology used, to help maintainers track validated security boundaries.

Note: Critical vulnerabilities found during this audit have been reported privately via HackerOne/Vercel Security. This issue only covers components verified as secure.

Audit Scope & Methodology

1. Font Parsing (src/font.ts)

Objective: Verify robustness against malformed font files and resource exhaustion attacks (DoS).
Library: @shuding/opentype.js (v1.4.0-beta.0)

Tests Performed:

• Fuzzing (test-font-fuzzing.ts): Tested with randomized headers, truncated files, and invalid offset tables.
• Resource Exhaustion (test-font-dos.ts): Tested with huge buffer allocations (1GB+) to check for OOM handling.

Result: SAFE

• The library correctly throws errors on invalid input.
• Memory allocation limits are respected.
• No crashes or unhandled exceptions observed during fuzzing.

2. Regular Expression Denial of Service (ReDoS)

Objective: Identify regex patterns vulnerable to catastrophic backtracking.
Components Audited:

• src/handler/expand.ts (CSS Property Expansion)
• src/parser/shape.ts (Shape Function Parsing)
• src/text/processor.ts (Text Transformation)

Tests Performed (test-redos.ts):

• Tested potentially dangerous patterns (e.g., nested quantifiers).
• Measured execution time with pathological inputs (100k+ characters).

Result: SAFE

• All regexes exhibited linear time complexity (O(n)).
• Execution times remained < 10ms for large inputs.
• No polynomial or exponential backtracking found.

3. Prototype Pollution

Objective: Verify if Object.assign or deep merge operations allow modifying Object.prototype.
Attack Vector: Injection of __proto__, constructor, or prototype via props or style objects.

Tests Performed (test-prototype-pollution.ts):

• Attempted to inject properties into the global prototype chain via deeply nested JSON payloads.

Result: SAFE

• Satori uses shallow copies or safe assignment patterns.
• No global prototype modification detected.

Reproduction Scripts

I have included the test scripts used for verification. You can run them to reproduce these results:

# Install dependencies
npm install

# Run negative test suite
npx tsx security-tests/test-font-dos.ts
npx tsx security-tests/test-font-fuzzing.ts
npx tsx security-tests/test-redos.ts
npx tsx security-tests/test-prototype-pollution.ts

Conclusion

The core components for font parsing, text processing, and object handling appear robust against common attack vectors. No further action is required for these specific areas.

---