CVE-2021-23346 (published 2021-03-04T17:15Z)

This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/HenrikJoreteg/html-parse-stringify
commit_details: repo_url: https://github.com/HenrikJoreteg/html-parse-stringify
author: Henrik Joreteg
author_date: 2021-02-26 10:37:18-08:00
msg: fixing reported ReDoS
repository: repo_url: https://github.com/HenrikJoreteg/html-parse-stringify
repo_name: HenrikJoreteg/html-parse-stringify
description: Parses well-formed HTML (meaning all tags closed) into an AST and back. quickly.
repo_language: JavaScript
owner: HenrikJoreteg
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -135,6 +135,7 @@ properties:
 
 ## changelog
 
+- `2.0.1` Addressing a reported regular expression denial of service issue reported by [Sam Sanoop](https://twitter.com/snoopysecurity) of [Snyk](https://snyk.io/) THANK YOU!. The issue was that sending certain input would cause one of the regular expressions we used to lock up and not finish, freezing the process. See the test that was added for details. To be clear, this lib wasn't meant for parsing non-well formed HTML. But, better safe than sorry! So we're fixing it.
 - `2.0.0` updated to more modern dependencies/build system. Switched to prettier, etc. No big feature differences, just new build system/project structure. Added support for top level text nodes thanks to @jperl. Added support for comments thanks to @pconerly.
 - `1.0.0 - 1.0.3` no big changes, bug fixes and speed improvements.
 

programming_language: Markdown
filename: parse.js
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-const tagRE = /<[a-zA-Z\-\!\/](?:"[^"]*"['"]*|'[^']*'['"]*|[^'">])*>/g
+const tagRE = /<[a-zA-Z\-\!\/](?:"[^"]*"|'[^']*'|[^'">])*>/g
 import parseTag from './parse-tag'
 
 // re-used obj for quick lookups of components

programming_language: JavaScript
filename: parse.js
change_type: ModificationType.MODIFY
diff: @@ -766,3 +766,19 @@ test('simple speed sanity check', function (t) {
 
   t.end()
 })
+
+test('ReDoS vulnerability reported by Sam Sanoop of Snyk', function (t) {
+  const start = Date.now()
+  // reported problematic string
+  HTML.parse(
+    "<!''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''!"
+  )
+  // other variant
+  HTML.parse(
+    '<!""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""!'
+  )
+  const duration = Date.now() - start
+
+  t.ok(duration < 100, 'should not hang')
+  t.end()
+})

programming_language: JavaScript