divyanshus2404 opened a new pull request, #71711: URL: https://github.com/apache/airflow/pull/71711
## Summary Replace the backtracking-prone regex in `SparkSubmitHook._mask_cmd()` with a linear-time token-based parser that eliminates the ReDoS vulnerability. ## Problem The original regex used nested lazy quantifiers (`\S*?`) with a lookahead `(?:(?!\2\s).)*` that causes **quadratic backtracking** on large inputs without `secret`/`password` keywords: | Input size | Original time | New time | |-----------|--------------|----------| | 10,000 chars | ~2s | <1ms | | 50,000 chars | ~57s | <1ms | | 100,000 chars | ~4min | ~1ms | An authenticated user with DAG trigger permissions could exploit this by passing large `application_args` via the REST API, blocking worker slots. ## Solution Replace the single regex with a token-based approach: 1. Split the command string by whitespace into tokens 2. Identify tokens containing `secret` or `password` (case-insensitive) 3. Mask the associated value (handling `key=value`, `key='quoted value'`, and `key value` forms) 4. Single forward pass — guaranteed O(n) ## Test plan - [x] All 8 existing parametrized `test_masks_passwords` cases pass with identical output - [x] `test_submit_log_tail_formats_and_masks_captured_lines` passes - [x] ReDoS payload (50k chars) completes in <1ms vs 57s before - [ ] CI passes Closes #70676 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
