CVE-2021-4437 (TypeScript, published 2024-02-12T20:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4. Affected by this issue is some unknown functionality of the file packages/json-deserializer/src/JsonDeserializer.ts of the component JSON Mime-Type Handler. The manipulation leads to inefficient regular expression complexity. Upgrading to version 1.1.0 is able to address this issue. The patch is identified as f689404d830cbc1edd6a1018d3334ff5f44dc6a6. It is recommended to upgrade the affected component. VDB-253406 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/dbartholomae/lambda-middleware
Files changed:
packages/json-deserializer/src/JsonDeserializer.test.ts
packages/json-deserializer/src/JsonDeserializer.ts
Commit message: fix(json-deserializer): fixed codeQL vulnerability

Removed the regex used to identify a JSON mime-type as this was potentially vulnerable to
'Regular expression Denial of Service attacks' and making changes to make the regex more restrictive (but compliant with RFC 6838) did not pass tests for this issue online.

This now matches based on the last segment of a mimetype being json or json; this should match all the expected mime types.

Updated unit-tests with additional tests for a variety of compatible mime types.


Vulnerable code:
  it("deserializes objects if the event has a json content-type header", async () => {
    const event: APIGatewayProxyEvent = createEvent({
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(testObject),
    });
    await handlerWithMiddleware(event, createContext());
    expect(processedEvent.bodyObject).toMatchObject(
      JSON.parse(JSON.stringify(testObject))
    );
import debugFactory, { IDebugger } from "debug";
const logger: IDebugger = debugFactory("@lambda-middleware/json-serializer");

  const mimePattern = /^application\/(.+\+)?json(;.*)?$/;
  return mimePattern.test(contentTypeHeader);

Fixed code:
  describe("deserializes objects the event has a valid json content-type header:", () => {
    it.each([
      ["subtype is json", "application/json"],
      ["subtype structured syntax specifier is json", "application/ld+json"],
      ["semicolon is appended", "application/json;"],
      ["whitespace is appended", "application/json;   "],
    ])("%s (%p)", async (_string, mimeType: string) => {
      const event: APIGatewayProxyEvent = createEvent({
        headers: { "Content-Type": mimeType },
        body: JSON.stringify(testObject),
      });
      await handlerWithMiddleware(event, createContext());
      expect(processedEvent.bodyObject).toMatchObject(
        JSON.parse(JSON.stringify(testObject))
      );
    });
  const mimeParts = contentTypeHeader.split("/");

  if (mimeParts.length != 2) {
    return false;
  }

  const lastSubtypePart = mimeParts[1].toLowerCase().split("+").pop()?.trim();

  return lastSubtypePart === "json" || lastSubtypePart === "json;";