Vulnerable Regular Expression

[cristianstaicu]

There are multiple regular expression used for parsing the user agent which are vulnerable to ReDoS, e.g.:

/(?=.*\bAndroid\b)(?=.*\bSD4930UR\b)/i

The slowdown is relatively serious because multiple such regexs are checked against the user agent: for 40.000 characters around 22 seconds matching time. I would suggest one of the following:

• remove the regex,
• anchor the regex,
• limit the number of characters that can be matched by the repetition,
• limit the input size.

If needed, I can provide an actual example showing the slowdown.

[sberney]

You could create a PR for this

[kaimallea]

Fixed by #77