Skip to content

fix(astro): Avoid RegExp creation during route interpolation #9815

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

Lms24
Copy link
Member

@Lms24 Lms24 commented Dec 13, 2023

Update: Added more detailed description after publishing Security Adivsory:

This PR fixes a security vulnerability in the @sentry/astro SDK. It fixes to CVE-2023-50249.

Summary: Previously, under certain conditions, we compiled a new RegExp for user-entered URL parameter values to interpolate a route name when starting a transaction. Unfortunately, we did not escape these parameter values, meaning that with the right regex and parameter combination, projects using our Astro SDK were exposed to a ReDos vulnerability.

For more information and to see if you were affected by the vulnerability (there are criteria to be affected), please refer to the security advisory.

This PR replaces the route interpolation that was previously based on compiling a RegExp for each parameter value:
Instead of this dynamic regex creation, we now

  • iterate over route segments to replace parameter values
  • decode raw url to match previously unmatched param values
  • prioritize multi-segment rest parameters before iterating over individual segments

@Lms24 Lms24 force-pushed the lms/fix-astro-escape-regex-characters-interpolate-route branch from 33e7685 to 72ad458 Compare December 13, 2023 11:04
@Lms24 Lms24 self-assigned this Dec 13, 2023
@Lms24 Lms24 marked this pull request as ready for review December 13, 2023 11:08
@Lms24 Lms24 requested review from mydea and lforst December 13, 2023 11:08
@Lms24 Lms24 force-pushed the lms/fix-astro-escape-regex-characters-interpolate-route branch from 59b8735 to 2b82b5a Compare December 13, 2023 11:30
@Lms24 Lms24 merged commit fe24eb5 into develop Dec 13, 2023
@Lms24 Lms24 deleted the lms/fix-astro-escape-regex-characters-interpolate-route branch December 13, 2023 12:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants