bignumber: parseFixed now contains a ReDoS since a9cdbe1238c149a7167c6bb1a78f314805b52755

[ChALkeR]

The new regex introduced in a9cdbe1 contains an IDA, and could cause a ReDoS on some crafted input.

import { parseFixed } from '@ethersproject/bignumber'

console.log(parseFixed('0.' + '0'.repeat(8e6) + '1')) // hangs

[ricmoo]

I was totally unfamiliar with the ReDoS attack; thanks for pointing it out to me and providing concise reproduction steps. :)

I’ll research this and get the fix out ASAP!

[ChALkeR]

The fix is in #1976 which I opened with this issue =).

[ricmoo]

Thanks! This will be fixed with #2016, which is removing the regex entirely.

Huge thanks for the info on ReDoS though, I need to spend more time understanding the intricacies of it.

Reminds me of the quote: "You have problem and think to yourself, 'I know! I can use a regular expression'. Now you have two problems." :)

[ricmoo]

This was fixed in 5.4.7. Please let me know if it seems fixed to you (I removed the regex entirely).

Thanks for your keen eye! :)

[ChALkeR]

This is now fixed.