Skip to content

GitLab

T
tangled
Commit e83dd93c authored by Dave Tapuska's avatar Dave Tapuska Committed by Commit Bot
Browse files
Options

Limit backtracking on regexp called from blink. 

It is possible to block the main thread with a invalid pattern, input
and CSS. Now that V8 has added a backtracking limit take advantage of it.
1000000 matches the limit Yarr (webkit's regex engine). See
https://github.com/WebKit/webkit/blob/89c28d471fae35f1788a0f857067896a10af8974/Source/JavaScriptCore/yarr/Yarr.h#L50

BUG=966405

Change-Id: I08bc956806bc7efb8cdc06dc0db30fa94e68df9c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1915280
Commit-Queue: Dave Tapuska <dtapuska@chromium.org>
Reviewed-by: default avatarJeremy Roman <jbroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#715312}
parent 3dacc95f
Hide whitespace changes
Inline Side-by-side
Showing with 19 additions and 2 deletions
third_party/blink/renderer/bindings/core/v8/script_regexp.cc
View file @ e83dd93c
...@@ -36,6 +36,10 @@ ...@@ -36,6 +36,10 @@
namespace blink { namespace blink {
namespace {
const uint32_t kBacktrackLimit = 1'000'000;
} // namespace
ScriptRegexp::ScriptRegexp(const String& pattern, ScriptRegexp::ScriptRegexp(const String& pattern,
TextCaseSensitivity case_sensitivity, TextCaseSensitivity case_sensitivity,
MultilineMode multiline_mode, MultilineMode multiline_mode,
...@@ -56,8 +60,9 @@ ScriptRegexp::ScriptRegexp(const String& pattern, ...@@ -56,8 +60,9 @@ ScriptRegexp::ScriptRegexp(const String& pattern,
flags |= v8::RegExp::kUnicode; flags |= v8::RegExp::kUnicode;
v8::Local<v8::RegExp> regex; v8::Local<v8::RegExp> regex;
if (v8::RegExp::New(context, V8String(isolate, pattern), if (v8::RegExp::NewWithBacktrackLimit(context, V8String(isolate, pattern),
static_cast<v8::RegExp::Flags>(flags)) static_cast<v8::RegExp::Flags>(flags),
kBacktrackLimit)
.ToLocal(&regex)) .ToLocal(&regex))
regex_.Set(isolate, regex); regex_.Set(isolate, regex);
if (try_catch.HasCaught() && !try_catch.Message().IsEmpty()) if (try_catch.HasCaught() && !try_catch.Message().IsEmpty())
......
third_party/blink/web_tests/external/wpt/html/semantics/forms/constraints/infinite_backtracking.html 0 → 100644
View file @ e83dd93c
<!DOCTYPE html>
<meta charset="utf-8">
<title>The infinite pattern validation test</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<input type=text id=badinput value="12345678901234567890123456789123456789z" pattern="(\d+)*$">
<script>
test(function(){
var elements = document.querySelectorAll(":invalid");
assert_array_equals(elements, [document.getElementById('badinput')]);
}, "Infinite backtracking pattern terminates");
</script>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment