divyanshus2404 opened a new pull request, #71711:
URL: https://github.com/apache/airflow/pull/71711

   ## Summary
   Replace the backtracking-prone regex in `SparkSubmitHook._mask_cmd()` with a 
linear-time token-based parser that eliminates the ReDoS vulnerability.
   
   ## Problem
   The original regex used nested lazy quantifiers (`\S*?`) with a lookahead 
`(?:(?!\2\s).)*` that causes **quadratic backtracking** on large inputs without 
`secret`/`password` keywords:
   
   | Input size | Original time | New time |
   |-----------|--------------|----------|
   | 10,000 chars | ~2s | <1ms |
   | 50,000 chars | ~57s | <1ms |
   | 100,000 chars | ~4min | ~1ms |
   
   An authenticated user with DAG trigger permissions could exploit this by 
passing large `application_args` via the REST API, blocking worker slots.
   
   ## Solution
   Replace the single regex with a token-based approach:
   1. Split the command string by whitespace into tokens
   2. Identify tokens containing `secret` or `password` (case-insensitive)
   3. Mask the associated value (handling `key=value`, `key='quoted value'`, 
and `key value` forms)
   4. Single forward pass — guaranteed O(n)
   
   ## Test plan
   - [x] All 8 existing parametrized `test_masks_passwords` cases pass with 
identical output
   - [x] `test_submit_log_tail_formats_and_masks_captured_lines` passes
   - [x] ReDoS payload (50k chars) completes in <1ms vs 57s before
   - [ ] CI passes
   
   Closes #70676


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to