Security Fix for Regular Expression Denial of Service (ReDoS) - huntr.dev

[huntr-helper]

https://huntr.dev/users/mufeedvh has fixed the Regular Expression Denial of Service (ReDoS) vulnerability 🔨. mufeedvh has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
GitHub Issue URL | #8
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/restql/1/README.md

User Comments:

📊 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-npm-restql

⚙️ Description *

restql is vulnerable to ReDoS (Regex Denial of Service) when we give an extended improper URL.

💻 Technical Description *

The project uses the module url-regex which is vulnerable to ReDoS, using the validator module instead of this one is enough to fix the issue.

🐛 Proof of Concept (PoC) *

var restql = require("restql");

/**
 * @constant {string} resource The resource to fetch.
 */
const resource = 'https://pokeapi.co.asdasdasd.asdsadasdsadsad.asdasdsad.asdsadasdsa.sadasdsadas.dasdasasdasd.432asdas3423.3423423423.234234243.234234234.23423423.24234.'

/**
 * @constant {Object} resolver The resolver to apply.
 */
const resolver = {
  'abilities[]?.ability.url': {
    'generation.url': {
      'main_region.url': null,
    },
  },
  'stats[].stat.url?': {
    'affecting_natures.increase[].url': null,
    'affecting_natures.decrease[].url': null,
  },
  'moves[].move?.url': null,
}

/**
 * @constant {Object} options The options to bypass.
 */
const options = {
  // ...
};

(async () => {
  try {
    const data = await restql(resource, resolver, options)

    console.log(data)
  } catch (error) {
    console.error(error.message)
  }
})()

After running the PoC:

The program halts (DoSed)

🔥 Proof of Fix (PoF) *

Throws the inbuilt error for invalid resource URLs

👍 User Acceptance Testing (UAT)

Just used the module validator instead of url-regex which is vulnerable to ReDoS.