mirror of
https://github.com/wekan/wekan.git
synced 2026-11-08 11:25:19 -05:00
Lauri Ojansivu
c2905e17ce
The ${"regex":...} token of a string-template custom field runs a pattern a
board member writes against a value another member writes. Rule e-mails format
card details on the server, so a pattern like (a+)+$ on 'aaaa...!' stopped the
one event loop for every user. The server now runs the regex in its own V8
context under a 50 ms limit, which V8 enforces inside backtracking, and pattern
and value are capped in length everywhere (the browser too, so one member's
format cannot hang the others'). A stopped regex leaves the token visible. The
negative test fails on any server call of the formatter without the bounded
runner.
Thanks to xet7 !
15 lines
609 B
JavaScript
15 lines
609 B
JavaScript
'use strict';
|
|
// A regex replacement that cannot stop the server: run in its own V8 context
|
|
// with a time limit, which V8 enforces even inside a backtracking regex.
|
|
// Server only (node:vm). See models/lib/customFieldStringTemplate.js.
|
|
const vm = require('node:vm');
|
|
|
|
const REGEX_TIME_LIMIT_MS = 50;
|
|
|
|
function boundedRegexReplace(value, regex, flags, replacement) {
|
|
return vm.runInNewContext('value.replace(new RegExp(regex, flags), replacement)',
|
|
{ value: String(value), regex, flags, replacement }, { timeout: REGEX_TIME_LIMIT_MS });
|
|
}
|
|
|
|
module.exports = { boundedRegexReplace, REGEX_TIME_LIMIT_MS };
|