This is an automated email from the ASF dual-hosted git repository. chibenwa pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/james-jdkim.git
commit b95d1a4c635b18a6734f791e6ebc9eb0373ba8bc Author: Benoit TELLIER <[email protected]> AuthorDate: Wed Nov 4 18:17:41 2026 +0100 [FIX] PublicKeyRecordImpl: check g= in linear time The granularity pattern "(atom)?\*?(atom)?" has two optional groups matching the same characters, "*" being atext. On a long g= value failing at its last character the matcher tried every split of the run between the groups: quadratic, seconds of CPU for a 6 KB key record that any domain owner can publish. As atext includes "*", the pattern accepts exactly the runs of atext: it is now a single possessive character class, same values, linear. --- .../org/apache/james/jdkim/tagvalue/PublicKeyRecordImpl.java | 10 ++++------ .../java/org/apache/james/jdkim/PublicKeyRecordTest.java | 12 ++++++++++++ 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/main/src/main/java/org/apache/james/jdkim/tagvalue/PublicKeyRecordImpl.java b/main/src/main/java/org/apache/james/jdkim/tagvalue/PublicKeyRecordImpl.java index 8ac8e75..5d64587 100644 --- a/main/src/main/java/org/apache/james/jdkim/tagvalue/PublicKeyRecordImpl.java +++ b/main/src/main/java/org/apache/james/jdkim/tagvalue/PublicKeyRecordImpl.java @@ -35,12 +35,10 @@ import java.util.regex.Pattern; public class PublicKeyRecordImpl extends TagValue implements PublicKeyRecord { - private static final String atom = "[a-zA-Z0-9!#$%&'*+/=?^_`{}|~-]+"; - // TODO this should support CFWS: are they supported in DKIM for real? - private static final String dotAtomText = "(" + atom + ")?\\*?(" + atom - + ")?"; - private static final Pattern granularityPattern = Pattern.compile("^" - + dotAtomText + "$"); + // Any run of atext: the same values as the former "(atom)?\*?(atom)?", atext including "*". + // One possessive class: the former pattern tried every split of the run between its two groups + // before failing, quadratic in the length of an invalid value. + private static final Pattern granularityPattern = Pattern.compile("^[a-zA-Z0-9!#$%&'*+/=?^_`{}|~-]*+$"); // SPEC: hyphenated-word = ALPHA [ *(ALPHA / DIGIT / "-") (ALPHA / DIGIT) ] private static final Pattern hyphenatedWordPattern = Pattern diff --git a/main/src/test/java/org/apache/james/jdkim/PublicKeyRecordTest.java b/main/src/test/java/org/apache/james/jdkim/PublicKeyRecordTest.java index e14489e..3027ed9 100644 --- a/main/src/test/java/org/apache/james/jdkim/PublicKeyRecordTest.java +++ b/main/src/test/java/org/apache/james/jdkim/PublicKeyRecordTest.java @@ -438,4 +438,16 @@ public class PublicKeyRecordTest { System.clearProperty(TagValue.STRICT_VALIDATION_PROPERTY); } } + + @Test(timeout = 1000) + public void longInvalidGranularityIsRejectedInLinearTime() { + StringBuilder g = new StringBuilder("joe"); + for (int i = 0; i < 60000; i++) { + g.append('*'); + } + g.append('.'); + PublicKeyRecord pkr = new PublicKeyRecordImpl("k=rsa; g=" + g + "; p=XXX"); + assertThatThrownBy(pkr::getGranularityPattern) + .isInstanceOf(IllegalStateException.class); + } } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
