jsinovassin opened a new pull request, #888:
URL: https://github.com/apache/unomi/pull/888
## Summary
- Backport of #872 to `unomi-3.0.x`, re-cut from the current branch head.
- The `matchesRegex` operator compiles and evaluates a pattern that an
unauthenticated caller supplies on the public context endpoint, against a
subject the same caller chooses. `java.util.regex` is a backtracking engine, so
one request can hold a thread.
- The operator now runs under guards that cap the pattern length at 512 and
the input length at 10000, cache compiled patterns in a bounded LRU, and abort
once a character-access budget of one million is exceeded. Each limit is
overridable by system property under `org.apache.unomi.conditions.regex`, and
well-behaved patterns keep the same semantics.
## Differences from master
- `AllITs` registers `ConditionRegexSafetyIT` alone. The other suites the
master commit lists do not exist on this line.
- `ConditionRegexSafetyIT` sends no API key, because the context endpoint is
public here. That is the surface an unbounded evaluation is reachable from.
## One test case added on each side
Both suites probe with `(a+)+$`. That pattern uses an unbounded quantifier,
and Java 17 optimizes the shape away, so it costs nothing: reverting the
operator to the unguarded `Pattern.compile(...).matcher(...).matches()` leaves
both of those cases green. They cannot discriminate on their own.
`^(a|a){0,60}z$` is not optimized. Its cost doubles with each added
character of the subject, measured on a Java 17 engine, and an unguarded
evaluation of 40 characters runs for hours. One case using that shape is added
to `PropertyConditionEvaluatorTest` and one to `ConditionRegexSafetyIT`.
The same addition is worth making on `master`, where both suites have the
same blind spot. It is not made here, so that this pull request stays a
backport.
## Test plan
- [x] `PropertyConditionEvaluatorTest` runs 15 cases and passes on JDK 17.
- [x] Mutation-checked: reverting the operator to the unguarded call turns 3
cases red, one of which is the case added here. Before that case existed the
same mutation turned only 2 red, and the catastrophic-backtracking case stayed
green.
- [x] `mvn test-compile` passes on `itests`.
- [ ] `ConditionRegexSafetyIT` under Karaf and Elasticsearch.
- [ ] CI
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
