fix vulnerable pattern in trim http://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016

leafo · leafo · commit 4a58f5c12582 · 2016-07-20T21:55:44.000-07:00
diff --git a/lapis/util.lua b/lapis/util.lua
@@ -167,7 +167,12 @@ uniquify = function(list)
   end)()
 end
 trim = function(str)
-  return tostring(str):match("^%s*(.-)%s*$")
+  str = tostring(str)
+  if #str > 200 then
+    return str:gsub("^%s+", ""):reverse():gsub("^%s+", ""):reverse()
+  else
+    return str:match("^%s*(.-)%s*$")
+  end
 end
 trim_all = function(tbl)
   for k, v in pairs(tbl) do
diff --git a/lapis/util.moon b/lapis/util.moon
@@ -102,7 +102,13 @@ uniquify = (list) ->
     seen[item] = true
     item
 
-trim = (str) -> tostring(str)\match "^%s*(.-)%s*$"
+trim = (str) ->
+  str = tostring str
+
+  if #str > 200
+    str\gsub("^%s+", "")\reverse()\gsub("^%s+", "")\reverse()
+  else
+    str\match "^%s*(.-)%s*$"
 
 trim_all = (tbl) ->
   for k,v in pairs tbl
diff --git a/spec/util_spec.moon b/spec/util_spec.moon
@@ -249,6 +249,11 @@ tests = {
     "blah blah"
   }
 
+  {
+    -> util.trim "   hello#{" "\rep 20000}world "
+    "hello#{" "\rep 20000}world"
+  }
+
   {
     -> util.trim_filter {
       "     ", " thing ",
