mirror of
https://github.com/2dust/v2rayN.git
synced 2026-09-26 08:18:00 +03:00
sdhfslandsdhfsl
05901b5673
Filter patterns (subscription subFilter, policy-group Filter, message MsgFilter) accept arbitrary user input while the tested text (remarks from subscriptions, log lines) is attacker-influenced. Regex.IsMatch without timeout hangs on evil patterns like (a+)+$ - a malicious subscription can freeze the UI/log pipeline on every update. Add Utils.IsRegexMatch with a 2s timeout; fail open (match) with a log so no node or message is silently dropped. Apply to all four call sites. Co-authored-by: sdhfsl <sdhfsl@users.noreply.github.com>
37 lines
1.1 KiB
C#
37 lines
1.1 KiB
C#
namespace ServiceLib.Tests.Helper;
|
|
|
|
public class RegexGuardTests
|
|
{
|
|
[Test]
|
|
public async Task IsRegexMatch_NormalPattern_ShouldMatch()
|
|
{
|
|
await Utils.IsRegexMatch("HK-node-01", "HK|香港").Should().BeTrue();
|
|
await Utils.IsRegexMatch("JP-node-01", "HK|香港").Should().BeFalse();
|
|
}
|
|
|
|
[Test]
|
|
public async Task IsRegexMatch_EmptyPattern_ShouldPassThrough()
|
|
{
|
|
await Utils.IsRegexMatch("anything", "").Should().BeTrue();
|
|
await Utils.IsRegexMatch("anything", null).Should().BeTrue();
|
|
}
|
|
|
|
[Test]
|
|
public async Task IsRegexMatch_InvalidPattern_ShouldFailOpen()
|
|
{
|
|
await Utils.IsRegexMatch("node-01", "([unclosed").Should().BeTrue();
|
|
}
|
|
|
|
[Test]
|
|
public async Task IsRegexMatch_EvilPattern_ShouldTimeoutAndFailOpen()
|
|
{
|
|
var sw = System.Diagnostics.Stopwatch.StartNew();
|
|
var result = Utils.IsRegexMatch(new string('a', 30) + "!", "(a+)+$");
|
|
sw.Stop();
|
|
|
|
await result.Should().BeTrue();
|
|
await (sw.Elapsed < TimeSpan.FromSeconds(30)).Should().BeTrue().Because(
|
|
$"evil pattern must be cut off by timeout, took {sw.Elapsed}");
|
|
}
|
|
}
|