Update Rust crate regex to 1.5.5 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
regex	dev-dependencies	minor	1.0 -> 1.5.5

GitHub Vulnerability Alerts

CVE-2022-24713

This is a cross-post of the official security advisory. The official advisory contains a signed version with our PGP key, as well.

The Rust Security Response WG was notified that the regex crate did not properly limit the complexity of the regular expressions (regex) it parses. An attacker could use this security issue to perform a denial of service, by sending a specially crafted regex to a service accepting untrusted regexes. No known vulnerability is present when parsing untrusted input with trusted regexes.

This issue has been assigned CVE-2022-24713. The severity of this vulnerability is "high" when the regex crate is used to parse untrusted regexes. Other uses of the regex crate are not affected by this vulnerability.

Overview

The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API.

Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes.

Affected versions

All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5.

Mitigations

We recommend everyone accepting user-controlled regexes to upgrade immediately to the latest version of the regex crate.

Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, we do not recommend denying known problematic regexes.

Acknowledgements

We want to thank Addison Crump for responsibly disclosing this to us according to the Rust security policy, and for helping review the fix.

We also want to thank Andrew Gallant for developing the fix, and Pietro Albini for coordinating the disclosure and writing this advisory.

---

Release Notes

rust-lang/regex (regex)

v1.5.5

Compare Source

==================
This releases fixes a security bug in the regex compiler. This bug permits a
vector for a denial-of-service attack in cases where the regex being compiled
is untrusted. There are no known problems where the regex is itself trusted,
including in cases of untrusted haystacks.

• SECURITY #GHSA-m5pq-gvj9-9vr8:
  Fixes a bug in the regex compiler where empty sub-expressions subverted the
  existing mitigations in place to enforce a size limit on compiled regexes.
  The Rust Security Response WG published an advisory about this:
  https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw

v1.5.4

Compare Source

==================
This release fixes another compilation failure when building regex. This time,
the fix is for when the pattern feature is enabled, which only works on
nightly Rust. CI has been updated to test this case.

• BUG #​772:
  Fix build when pattern feature is enabled.

v1.5.3

Compare Source

==================
This releases fixes a bug when building regex with only the unicode-perl
feature. It turns out that while CI was building this configuration, it wasn't
actually failing the overall build on a failed compilation.

• BUG #​769:
  Fix build in regex-syntax when only the unicode-perl feature is enabled.

v1.5.2

Compare Source

==================
This release fixes a performance bug when Unicode word boundaries are used.
Namely, for certain regexes on certain inputs, it's possible for the lazy DFA
to stop searching (causing a fallback to a slower engine) when it doesn't
actually need to.

PR #​768 fixes the bug, which was
originally reported in
ripgrep#1860.

v1.5.1

Compare Source

==================
This is a patch release that fixes a compilation error when the perf-literal
feature is not enabled.

v1.5.0

Compare Source

==================
This release primarily updates to Rust 2018 (finally) and bumps the MSRV to
Rust 1.41 (from Rust 1.28). Rust 1.41 was chosen because it's still reasonably
old, and is what's in Debian stable at the time of writing.

This release also drops this crate's own bespoke substring search algorithms
in favor of a new
memmem implementation provided by the memchr crate.
This will change the performance profile of some regexes, sometimes getting a
little worse, and hopefully more frequently, getting a lot better. Please
report any serious performance regressions if you find them.

v1.4.6

Compare Source

==================
This is a small patch release that fixes the compiler's size check on how much
heap memory a regex uses. Previously, the compiler did not account for the
heap usage of Unicode character classes. Now it does. It's possible that this
may make some regexes fail to compile that previously did compile. If that
happens, please file an issue.

• BUG OSS-fuzz#33579:
  Some regexes can use more heap memory than one would expect.

v1.4.5

Compare Source

==================
This is a small patch release that fixes a regression in the size of a Regex
in the 1.4.4 release. Prior to 1.4.4, a Regex was 552 bytes. In the 1.4.4
release, it was 856 bytes due to internal changes. In this release, a Regex
is now 16 bytes. In general, the size of a Regex was never something that was
on my radar, but this increased size in the 1.4.4 release seems to have crossed
a threshold and resulted in stack overflows in some programs.

• BUG #​750:
  Fixes stack overflows seemingly caused by a large Regex size by decreasing
  its size.

v1.4.4

Compare Source

==================
This is a small patch release that contains some bug fixes. Notably, it also
drops the thread_local (and lazy_static, via transitivity) dependencies.

Bug fixes:

• BUG #​362:
  Memory leaks caused by an internal caching strategy should now be fixed.
• BUG #​576:
  All regex types now implement UnwindSafe and RefUnwindSafe.
• BUG #​728:
  Add missing Replacer impls for Vec<u8>, String, Cow, etc.

v1.4.3

Compare Source

==================
This is a small patch release that adds some missing standard trait
implementations for some types in the public API.

Bug fixes:

• BUG #​734:
  Add FusedIterator and ExactSizeIterator impls to iterator types.
• BUG #​735:
  Add missing Debug impls to public API types.

v1.4.2

Compare Source

==================
This is a small bug fix release that bans \P{any}. We previously banned empty
classes like [^\w\W], but missed the \P{any} case. In the future, we hope
to permit empty classes.

• BUG #​722:
  Ban \P{any} to avoid a panic in the regex compiler. Found by OSS-Fuzz.

v1.4.1

Compare Source

==================
This is a small bug fix release that makes \p{cf} work. Previously, it would
report "property not found" even though cf is a valid abbreviation for the
Format general category.

• BUG #​719:
  Fixes bug that prevented \p{cf} from working.

v1.4.0

Compare Source

==================
This releases has a few minor documentation fixes as well as some very minor
API additions. The MSRV remains at Rust 1.28 for now, but this is intended to
increase to at least Rust 1.41.1 soon.

This release also adds support for OSS-Fuzz. Kudos to
@​DavidKorczynski
for doing the heavy lifting for that!

New features:

• FEATURE #​649:
  Support [, ] and . in capture group names.
• FEATURE #​687:
  Add is_empty predicate to RegexSet.
• FEATURE #​689:
  Implement Clone for SubCaptureMatches.
• FEATURE #​715:
  Add empty constructor to RegexSet for convenience.

Bug fixes:

• BUG #​694:
  Fix doc example for Replacer::replace_append.
• BUG #​698:
  Clarify docs for s flag when using a bytes::Regex.
• BUG #​711:
  Clarify is_match docs to indicate that it can match anywhere in string.

v1.3.9

Compare Source

==================
This release fixes a MSRV (Minimum Support Rust Version) regression in the
1.3.8 release. Namely, while 1.3.8 compiles on Rust 1.28, it actually does not
compile on other Rust versions, such as Rust 1.39.

Bug fixes:

• BUG #​685:
  Remove use of doc_comment crate, which cannot be used before Rust 1.43.

v1.3.8

Compare Source

==================
This release contains a couple of important bug fixes driven
by better support for empty-subexpressions in regexes. For
example, regexes like b| are now allowed. Major thanks to
@​sliquister for implementing support for this
in #​677.

Bug fixes:

• BUG #​523:
  Add note to documentation that spaces can be escaped in x mode.
• BUG #​524:
  Add support for empty sub-expressions, including empty alternations.
• BUG #​659:
  Fix match bug caused by an empty sub-expression miscompilation.

v1.3.7

Compare Source

==================
This release contains a small bug fix that fixes how regex forwards crate
features to regex-syntax. In particular, this will reduce recompilations in
some cases.

Bug fixes:

• BUG #​665:
  Fix feature forwarding to regex-syntax.

v1.3.6

Compare Source

==================
This release contains a sizable (~30%) performance improvement when compiling
some kinds of large regular expressions.

Performance improvements:

• PERF #​657:
  Improvement performance of compiling large regular expressions.

v1.3.5

Compare Source

==================
This release updates this crate to Unicode 13.

New features:

• FEATURE #​653:
  Update regex-syntax to Unicode 13.

v1.3.4

Compare Source

==================
This is a small bug fix release that fixes a bug related to the scoping of
flags in a regex. Namely, before this fix, a regex like ((?i)a)b) would
match aB despite the fact that b should not be matched case insensitively.

Bug fixes:

• BUG #​640:
  Fix bug related to the scoping of flags in a regex.

v1.3.3

Compare Source

==================
This is a small maintenance release that upgrades the dependency on
thread_local from 0.3 to 1.0. The minimum supported Rust version remains
at Rust 1.28.

v1.3.2

Compare Source

==================
This is a small maintenance release with some house cleaning and bug fixes.

New features:

• FEATURE #​631:
  Add a Match::range method an a From<Match> for Range impl.

Bug fixes:

• BUG #​521:
  Corrects /-/.splitn("a", 2) to return ["a"] instead of ["a", ""].
• BUG #​594:
  Improve error reporting when writing \p\.
• BUG #​627:
  Corrects /-/.split("a-") to return ["a", ""] instead of ["a"].
• BUG #​633:
  Squash deprecation warnings for the std::error::Error::description method.

v1.3.1

Compare Source

==================
This is a maintenance release with no changes in order to try to work-around
a docs.rs/Cargo issue.

v1.3.0

Compare Source

==================
This release adds a plethora of new crate features that permit users of regex
to shrink its size considerably, in exchange for giving up either functionality
(such as Unicode support) or runtime performance. When all such features are
disabled, the dependency tree for regex shrinks to exactly 1 crate
(regex-syntax). More information about the new crate features can be
found in the docs.

Note that while this is a new minor version release, the minimum supported
Rust version for this crate remains at 1.28.0.

New features:

• FEATURE #​474:
  The use_std feature has been deprecated in favor of the std feature.
  The use_std feature will be removed in regex 2. Until then, use_std will
  remain as an alias for the std feature.
• FEATURE #​583:
  Add a substantial number of crate features shrinking regex.

v1.2.1

Compare Source

==================
This release does a bit of house cleaning. Namely:

• This repository is now using rustfmt.
• License headers have been removed from all files, in following suit with the
  Rust project.
• Teddy has been removed from the regex crate, and is now part of the
  aho-corasick crate.
  See aho-corasick's new packed sub-module for details.
• The utf8-ranges crate has been deprecated, with its functionality moving
  into the
  utf8 sub-module of regex-syntax.
• The ucd-util dependency has been dropped, in favor of implementing what
  little we need inside of regex-syntax itself.

In general, this is part of an ongoing (long term) effort to make optimizations
in the regex engine easier to reason about. The current code is too convoluted
and thus it is very easy to introduce new bugs. This simplification effort is
the primary motivation behind re-working the aho-corasick crate to not only
bundle algorithms like Teddy, but to also provide regex-like match semantics
automatically.

Moving forward, the plan is to join up with the bstr and regex-automata
crates, with the former providing more sophisticated substring search
algorithms (thereby deleting existing code in regex) and the latter providing
ahead-of-time compiled DFAs for cases where they are inexpensive to compute.

v1.2.0

Compare Source

==================
This release updates regex's minimum supported Rust version to 1.28, which was
release almost 1 year ago. This release also updates regex's Unicode data
tables to 12.1.0.

v1.1.9

Compare Source

==================
This release contains a bug fix that caused regex's tests to fail, due to a
dependency on an unreleased behavior in regex-syntax.

• BUG #​593:
  Move an integration-style test on error messages into regex-syntax.

v1.1.8

Compare Source

==================
This release contains a few small internal refactorings. One of which fixes
an instance of undefined behavior in a part of the SIMD code.

Bug fixes:

• BUG #​545:
  Improves error messages when a repetition operator is used without a number.
• BUG #​588:
  Removes use of a repr(Rust) union used for type punning in the Teddy matcher.
• BUG #​591:
  Update docs for running benchmarks and improve failure modes.

v1.1.7

Compare Source

==================
This release fixes up a few warnings as a result of recent deprecations.

v1.1.6

Compare Source

==================
This release fixes a regression introduced by a bug fix (for
BUG #​557) which could cause
the regex engine to enter an infinite loop. This bug was originally
reported against ripgrep.

v1.1.5

Compare Source

==================
This release fixes a bug in regex's dependency specification where it requires
a newer version of regex-syntax, but this wasn't communicated correctly in the
Cargo.toml. This would have been caught by a minimal version check, but this
check was disabled because the rand crate itself advertises incorrect
dependency specifications.

Bug fixes:

• BUG #​570:
  Fix regex-syntax minimal version.

v1.1.4

Compare Source

==================
This release fixes a backwards compatibility regression where Regex was no
longer UnwindSafe. This was caused by the upgrade to aho-corasick 0.7, whose
AhoCorasick type was itself not UnwindSafe. This has been fixed in aho-corasick
0.7.4, which we now require.

Bug fixes:

• BUG #​568:
  Fix an API regression where Regex was no longer UnwindSafe.

v1.1.3

Compare Source

==================
This releases fixes a few bugs and adds a performance improvement when a regex
is a simple alternation of literals.

Performance improvements:

• OPT #​566:
  Upgrades aho-corasick to 0.7 and uses it for foo|bar|...|quux regexes.

Bug fixes:

• BUG #​527:
  Fix a bug where the parser would panic on patterns like ((?x)).
• BUG #​555:
  Fix a bug where the parser would panic on patterns like (?m){1,1}.
• BUG #​557:
  Fix a bug where captures could lead to an incorrect match.

v1.1.2

Compare Source

==================
This release fixes a bug found in the fix introduced in 1.1.1.

Bug fixes:

• BUG edf45e6f:
  Fix bug introduced in reverse suffix literal matcher in the 1.1.1 release.

v1.1.1

Compare Source

==================
This is a small release with one fix for a bug caused by literal optimizations.

Bug fixes:

• BUG 661bf53d:
  Fixes a bug in the reverse suffix literal optimization. This was originally
  reported
  against ripgrep.

v1.1.0

Compare Source

==================
This is a small release with a couple small enhancements. This release also
increases the minimal supported Rust version (MSRV) to 1.24.1 (from 1.20.0). In
accordance with this crate's MSRV policy, this release bumps the minor version
number.

Performance improvements:

• OPT #​511,
  OPT #​540:
  Improve lazy DFA construction for large regex sets.

New features:

• FEATURE #​538:
  Add Emoji and "break" Unicode properties. See UNICODE.md.

Bug fixes:

• BUG #​530:
  Add Unicode license (for data tables).
• Various typo/doc fixups.

v1.0.6

Compare Source

==================
This is a small release.

Performance improvements:

• OPT #​513:
  Improve performance of compiling large Unicode classes by 8-10%.

Bug fixes:

• BUG #​533:
  Fix definition of [[:blank:]] class that regressed in regex-syntax 0.5.

v1.0.5

Compare Source

==================
This is a small release with an API enhancement.

New features:

• FEATURE #​509:
  Generalize impls of the Replacer trait.

v1.0.4

Compare Source

==================
This is a small release that bumps the quickcheck dependency.

v1.0.3

Compare Source

==================
This is a small bug fix release.

Bug fixes:

• BUG #​504:
  Fix for Cargo's "minimal version" support.
• BUG 1e39165f:
  Fix doc examples for byte regexes.

v1.0.2

Compare Source

==================
This release exposes some new lower level APIs on Regex that permit
amortizing allocation and controlling the location at which a search is
performed in a more granular way. Most users of the regex crate will not
need or want to use these APIs.

New features:

• FEATURE #​493:
  Add a few lower level APIs for amortizing allocation and more fine grained
  searching.

Bug fixes:

• BUG 3981d2ad:
  Correct outdated documentation on RegexBuilder::dot_matches_new_line.
• BUG 7ebe4ae0:
  Correct outdated documentation on Parser::allow_invalid_utf8 in the
  regex-syntax crate.
• BUG 24c7770b:
  Fix a bug in the HIR printer where it wouldn't correctly escape meta
  characters in character classes.

v1.0.1

Compare Source

==================
This release upgrades regex's Unicode tables to Unicode 11, and enables SIMD
optimizations automatically on Rust stable (1.27 or newer).

New features:

• FEATURE #​486:
  Implement size_hint on RegexSet match iterators.
• FEATURE #​488:
  Update Unicode tables for Unicode 11.
• FEATURE #​490:
  SIMD optimizations are now enabled automatically in Rust stable, for versions
  1.27 and up. No compilation flags or features need to be set. CPU support
  SIMD is detected automatically at runtime.

Bug fixes:

• BUG #​482:
  Present a better compilation error when the use_std feature isn't used.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.