Vulnerable Regular Expression in vfsjfilechooser2

[yetingli]

Type of Issue
Potential Regex Denial of Service (ReDoS)

Description
The vulnerable regular expression is located in

vfsjfilechooser2/src/main/java/com/googlecode/vfsjfilechooser2/utils/VFSURIValidator.java

Line 235 in 5a5f348

Pattern p_ftp2 = Pattern

The ReDOS vulnerability can be exploited with the following string
ftp://:@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::

You can execute the following code to reproduce ReDos

import com.googlecode.vfsjfilechooser2.utils.VFSURIValidator;

public class Main {
    public static void main(String[] args) {
        VFSURIValidator v = new VFSURIValidator();
        String _uri = "ftp://:@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::@::";
        System.out.println(v.isValid(_uri));
    }
}

I think you can limit the input length or modify this regex.

[fracpete]

This project hasn't been under active development for a number of years (I no longer use it). Propose a patch that mitigates the problem and I'll have a look at it.

[yetingli]

This project hasn't been under active development for a number of years (I no longer use it). Propose a patch that mitigates the problem and I'll have a look at it.

I am willing to suggest that you replace the Pattern p_ftp2 (ftp|FTP|sftp|SFTP|http|HTTP|https|HTTPS|webdav|WEBDAV|smb|SMB)://(.+:.+@)*([^:]+?/*)([ ]*:[0-9]+)*([ ]*:)*(/.*) with (ftp|FTP|sftp|SFTP|http|HTTP|https|HTTPS|webdav|WEBDAV|smb|SMB)://([^:@]+:[^:@]+@)*([^:]+?/*)([ ]*:[0-9]+)*([ ]*:)*(/.*)

Similarly, Pattern p_ftp3 can also be modified in this way.

Feel free to contact me if you have any questions on these vulnerability disclosures :).

[fracpete]

Thanks for that. Tested and incorporated the fix. Also fixed handling of specials chars in passwords, which need to be URL encoded. Pushed out a new release (0.2.9) to Maven Central.

[OS-WS]

Hi, Was CVE-2021-29061 fixed?
If so, in what commit/version?

Thanks!!

[fracpete]

0.2.9 as it says in the comment before your comment.