Taranpreet Kaur created FLINK-40189:
---------------------------------------
Summary: Found Security Vunerability in IndexGeneratorFactory.java
Key: FLINK-40189
URL: https://issues.apache.org/jira/browse/FLINK-40189
Project: Flink
Issue Type: Bug
Components: Connectors / Opensearch
Reporter: Taranpreet Kaur
Problem
Two regex patterns are vulnerable to catastrophic backtracking
(polynomial/exponential runtime):
Line 207 — dynamicIndexTimeExtractPattern:
Pattern.compile(".*\\\{.+\\|.*\\}.*");
Line 209 — dynamicIndexSystemTimeExtractPattern:
Pattern.compile(".*\\\{\\s*(now\\(\\s*\\)|NOW\\(\\s*\\)|current_timestamp|CURRENT_TIMESTAMP)\\s*\\|.*\\}.*");
Why These Are Vulnerable
Both patterns use multiple overlapping greedy quantifiers (.*, .+, .*) that
can match the same characters. When the regex
engine fails to find a match, it backtracks through all possible combinations
of how to split the input between these
quantifiers.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
