CVE-2023-26103 (published 2023-02-25T05:15Z)

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.\r\r

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/denoland/deno
commit_details: repo_url: https://github.com/denoland/deno
author: Bert Belder
author_date: 2023-02-10 20:41:20+01:00
msg: refactor(ext/http): use `String.prototype.trim()` instead of regex (#17722)
repository: repo_url: https://github.com/denoland/deno
repo_name: denoland/deno
description: A modern runtime for JavaScript and TypeScript.
repo_language: Rust
owner: denoland
file_changes: filename: 01_http.js
change_type: ModificationType.MODIFY
diff: @@ -51,6 +51,7 @@ const {
   StringPrototypeIncludes,
   StringPrototypeToLowerCase,
   StringPrototypeSplit,
+  StringPrototypeTrim,
   Symbol,
   SymbolAsyncIterator,
   TypeError,
@@ -393,8 +394,9 @@ function upgradeWebSocket(request, options = {}) {
   const upgrade = request.headers.get("upgrade");
   const upgradeHasWebSocketOption = upgrade !== null &&
     ArrayPrototypeSome(
-      StringPrototypeSplit(upgrade, /\s*,\s*/),
-      (option) => StringPrototypeToLowerCase(option) === "websocket",
+      StringPrototypeSplit(upgrade, ","),
+      (option) =>
+        StringPrototypeToLowerCase(StringPrototypeTrim(option)) === "websocket",
     );
   if (!upgradeHasWebSocketOption) {
     throw new TypeError(
@@ -405,8 +407,9 @@ function upgradeWebSocket(request, options = {}) {
   const connection = request.headers.get("connection");
   const connectionHasUpgradeOption = connection !== null &&
     ArrayPrototypeSome(
-      StringPrototypeSplit(connection, /\s*,\s*/),
-      (option) => StringPrototypeToLowerCase(option) === "upgrade",
+      StringPrototypeSplit(connection, ","),
+      (option) =>
+        StringPrototypeToLowerCase(StringPrototypeTrim(option)) === "upgrade",
     );
   if (!connectionHasUpgradeOption) {
     throw new TypeError(

programming_language: TypeScript