Newer1107 opened a new pull request, #72204: URL: https://github.com/apache/airflow/pull/72204
## Problem The `_mask_cmd()` method in `SparkSubmitHook` uses a regex with a nested lookahead `(?:(?!\2\s).)*` combined with `\S*?` that causes **quadratic backtracking** (O(nĀ²)) on inputs without the `secret`/`password` pattern. An authenticated user can trigger a DoS by passing crafted `application_args` via the DAG trigger API. | Input size | Before | After | |-----------|--------|-------| | 10,000 chars | ~2s | <1ms | | 50,000 chars | ~57s | <1ms | ## Fix Replace the vulnerable regex with: - `\b\w*` for the key part (word boundary limits search space) - `\S+` for the value (no backtracking possible) This eliminates catastrophic backtracking while preserving the same masking behavior. ## Verification Tested with: - `HivePassword=abc123` ā `HivePassword=******` - `secret=mysecret` ā `secret=******` - `password="mypassword"` ā `password="******"` - 50,000 char input: <1ms (was 57s) Resolves #70676 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
