T09 · Insecure Skill Coding Practices
Warning
- Location
src/content-analyzer.js:253- Finding
User-Controlled Regular Expression Enables Denial of Service
- Content
View full analysis
seoEngine.optimizeContent(content, keywords), ``` ### Technical Analysis Each caller-supplied keyword is passed directly to the JavaScript `RegExp` constructor without escaping regular-expression metacharacters. The implementation consequently treats keywords as executable regular-expression patterns rather than literal search strings. A malformed keyword such as `[` causes `new RegExp()` to throw a syntax exception. More importantly, an attacker can supply a pattern with catastrophic backtracking characteristics, such as `(a+)+$`, together with long matching content that fails near its end. JavaScript regular-expression evaluation is synchronous and has no built-in execution timeout, so this can monopolize the Node.js event-loop thread. The Skill does not impose effective limits on content length, keyword length, keyword count, or regular-expression complexity. Although the `SEOEngine` constructor contains a `maxKeywords` configuration value, it is not enforced in this path. ### Attack Path 1. An application exposes or internally invokes the exported `optimizeContent(content, keywords)` operation with untrusted input. 2. The attacker supplies a pathological keyword such as `(a+)+$`. 3. The attacker supplies a large content value consisting of many `a` characters followed by a nonmatching character. 4. ` ...[truncated 1060 chars]- Remediation
View remediation
0 ? (occurrences / wordCount) * 100 : 0; } ``` If regular expressions are required, escape all metacharacters first: ```javascript const escapedKeyword = keywordLower.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); const occurrences = (contentLower.match(new RegExp(escapedKeyword, 'g')) || []).length; ``` Additional hardening should include: - Validate that `content` is a string and `keywords` is an array of strings. - Enforce maximum content and keyword lengths. - Enforce the configured maximum keyword count. - Reject empty keywords. - Apply request-level timeouts and rate limits in service integrations. - Run CPU-intensive analysis in isolated workers when processing untrusted input. - Add tests for malformed patterns such as `[`, literal metacharacters, empty content, and pathological inputs such as `(a+)+$`. ]]>