T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/search_docs.py:95- Finding
Regular Expression Denial of Service Through Unrestricted Search Patterns
- Content
View full analysis
List[Tuple[int, str]]: """Search for regex matches, returning matching lines.""" try: regex = re.compile(pattern, re.IGNORECASE) except re.error as e: print(f"Invalid regex pattern: {e}", file=sys.stderr) return [] lines = text.split('\n') matches = [] for i, line in enumerate(lines): if regex.search(line): matches.append((i + 1, line.strip())) ``` The pattern originates from the positional `query` command-line argument and is passed to this function when the user selects `--mode regex`: ```python search_fn = keyword_search if mode == "keyword" else regex_search ... matches = search_fn(query, article.content) ``` ### Technical Analysis The application compiles and evaluates an unrestricted, user-supplied regular expression using Python's backtracking `re` engine. Although malformed expressions are caught, syntactically valid patterns with nested or ambiguous quantifiers can require exponential processing time on crafted input. For example, a pattern such as: ```text (a+)+$ ``` can cause catastrophic backtracking when evaluated against a sufficiently long documentation line consisting of many `a` characters followed by a nonmatching character. There is no pattern-complexity validation, input-length limit, matching timeout, or process-level resource boundary. The risk applies when the query is controlled by an untrusted caller, including cases where an agent invokes the script using search terms taken from an untrusted prompt. Exploitation also requires a sufficiently adverse line in the searched Markdown corpus, whether naturally present or attacker-controlled. ### Attack Path 1. The attacker supplies a pathological r ...[truncated 1297 chars]- Remediation
View remediation