CVE-2019-25103 (published 2023-02-12T15:15Z)

A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file simple-markdown.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. Upgrading to version 0.5.2 is able to address this issue. The patch is named 89797fef9abb4cab2fb76a335968266a92588816. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220639.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/ariabuckles/simple-markdown
commit_details: repo_url: https://github.com/ariabuckles/simple-markdown
author: Aria Buckles
author_date: 2019-08-30 18:30:01-07:00
msg: inlineCode: Fix ReDoS & improve escape semantics

Our inline code regex had overlapping parts in the case of spaces;
spaces could be parsed as part of the `\s*`s or as part of the
`[\S\s]*`, which leads to catastrophic backtracking in the case of
a string with many spaces.

The `\s*` parts were attempting to allow for escaping of backticks
within the start/end of inline code blocks, so this commit removes
the `\s*` parts of the regex, and then after parsing the code block,
checks for the case where a single space is being used to escape
a backtick, and removes that space.

Test plan:

1. Added a test for the semantics change.
2. Added a test for the exponential backtracking to match the test
   case in issue #71
repository: repo_url: https://github.com/ariabuckles/simple-markdown
repo_name: ariabuckles/simple-markdown
description: JavaScript markdown parsing, made simple
repo_language: JavaScript
owner: ariabuckles
file_changes: filename: simple-markdown-test.js
change_type: ModificationType.MODIFY
diff: @@ -550,6 +550,26 @@ describe("simple markdown", function() {
             }]);
         });
 
+        it("should ignore a single space at the start and end of an inline code block separating a '`'", function() {
+            var parsed1 = inlineParse(
+                "test `` ` `` escaping a code block"
+            );
+            validateParse(parsed1, [
+                {type: "text", content: "test "},
+                {type: "inlineCode", content: "`"},
+                {type: "text", content: " escaping a code block"},
+            ]);
+
+            var parsed1 = inlineParse(
+                "test ``  `  `` escaping a code block"
+            );
+            validateParse(parsed1, [
+                {type: "text", content: "test "},
+                {type: "inlineCode", content: " ` "},
+                {type: "text", content: " escaping a code block"},
+            ]);
+        });
+
         it("should allow you to escape special characters with \\", function() {
             var parsed = inlineParse(
                 "\\`hi\\` \\*bye\\* \\~\\|\\<\\[\\{"

programming_language: JavaScript
filename: simple-markdown.js
change_type: ModificationType.MODIFY
diff: @@ -640,6 +640,7 @@ var LIST_ITEM_R = new RegExp(
     "gm"
 );
 var BLOCK_END_R = /\n{2,}$/;
+var INLINE_CODE_ESCAPE_BACKTICKS_R = /^ ( *` *) $|^ ( *`)|(` *) $/g;
 // recognize the end of a paragraph block inside a list item:
 // two or more newlines at end end of the item
 var LIST_BLOCK_END_R = BLOCK_END_R;
@@ -1581,10 +1582,10 @@ var defaultRules /* : DefaultRules */ = {
     },
     inlineCode: {
         order: currOrder++,
-        match: inlineRegex(/^(`+)\s*([\s\S]*?[^`])\s*\1(?!`)/),
+        match: inlineRegex(/^(`+)([\s\S]*?[^`])\1(?!`)/),
         parse: function(capture, parse, state) {
             return {
-                content: capture[2]
+                content: capture[2].replace(INLINE_CODE_ESCAPE_BACKTICKS_R, "$1")
             };
         },
         react: function(node, output, state) {

programming_language: TypeScript