Vulnerability: Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service. ### Impact
The regex injection that may lead to Denial of Service.

### Patches
Will be patched in 2.4 and 3.0

### Workarounds
Versions lower than 2.x are only affected if the navigation module is added

### References
See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304

If you have any questions or comments about this advisory please [send us an Email](https://www.graphhopper.com/contact-form/) or create a topic [here](https://discuss.graphhopper.com/).
Vulnerability ID: GHSA-hf44-3mx6-vhhw
CWE: CWE-400
Severity score: 6.5
Project: https://github.com/graphhopper/graphhopper
Published: 2021-05-19
File: navigation/src/main/java/com/graphhopper/navigation/NavigateResource.java
Commit message: avoid regex in navigate module (#2304)

* replace two regexs with one indexOf

* make check stricter

* use @easbar's suggestion
Commit author: Peter

Vulnerable version (before fix):
 private GHResponse calcRoute(List<Double> favoredHeadings, List<GHPoint> request      * The url looks like: ".../{profile}/1.522438,42.504606;1.527209,42.504776;1.526113,42.505144;1.527218,42.50529?.."      */     private List<GHPoint> getPointsFromRequest(HttpServletRequest httpServletRequest, String profile) {          String url = httpServletRequest.getRequestURI();         url = url.replaceFirst("/navigate/directions/v5/gh/" + profile + "/", "");         url = url.replaceAll("\\?[*]", "");          String[] pointStrings = url.split(";");          List<GHPoint> points = new ArrayList<>(pointStrings.length);         for (int i = 0; i < pointStrings.length; i++) {             points.add(GHPoint.fromStringLonLat(pointStrings[i]));

Fixed version (after fix):
 private GHResponse calcRoute(List<Double> favoredHeadings, List<GHPoint> request      * The url looks like: ".../{profile}/1.522438,42.504606;1.527209,42.504776;1.526113,42.505144;1.527218,42.50529?.."      */     private List<GHPoint> getPointsFromRequest(HttpServletRequest httpServletRequest, String profile) {         String url = httpServletRequest.getRequestURI();         String urlStart = "/navigate/directions/v5/gh/" + profile + "/";         if (!url.startsWith(urlStart)) throw new IllegalArgumentException("Incorrect URL " + url);         url = url.substring(urlStart.length());         String[] pointStrings = url.split(";");         List<GHPoint> points = new ArrayList<>(pointStrings.length);         for (int i = 0; i < pointStrings.length; i++) {             points.add(GHPoint.fromStringLonLat(pointStrings[i]));

Patch:
patch: @@ -188,13 +188,11 @@ private GHResponse calcRoute(List<Double> favoredHeadings, List<GHPoint> request
      * The url looks like: ".../{profile}/1.522438,42.504606;1.527209,42.504776;1.526113,42.505144;1.527218,42.50529?.."
      */
     private List<GHPoint> getPointsFromRequest(HttpServletRequest httpServletRequest, String profile) {
-
         String url = httpServletRequest.getRequestURI();
-        url = url.replaceFirst("/navigate/directions/v5/gh/" + profile + "/", "");
-        url = url.replaceAll("\\?[*]", "");
-
+        String urlStart = "/navigate/directions/v5/gh/" + profile + "/";
+        if (!url.startsWith(urlStart)) throw new IllegalArgumentException("Incorrect URL " + url);
+        url = url.substring(urlStart.length());
         String[] pointStrings = url.split(";");
-
         List<GHPoint> points = new ArrayList<>(pointStrings.length);
         for (int i = 0; i < pointStrings.length; i++) {
             points.add(GHPoint.fromStringLonLat(pointStrings[i]));
path: navigation/src/main/java/com/graphhopper/navigation/NavigateResource.java