Because of backtracking in the matching algorithm, URLPatternList is likely susceptible to ReDoS (Regex Denial-of-Service) attacks where malicious URLs trigger catastrophic backtracking in vulnerably URL patterns. These problems might also exist in the underlying VM's regex implementation that evaluates regex groups, though those might be harder to guard.
Because we do our own pattern parsing and evaluation (except regex groups), we have some flexibility in how to handle this:
- Set a backtracking limit within our own matching, enforced across all backtracking locations.
- Ban regex groups completely, or add an option to
- Statically analyze and allow only a subset of regex groups
URLPattern itself may also have ReDoS vulnerabilities. It would be best if our mitigations matched what implementors do.
We should:
Because of backtracking in the matching algorithm, URLPatternList is likely susceptible to ReDoS (Regex Denial-of-Service) attacks where malicious URLs trigger catastrophic backtracking in vulnerably URL patterns. These problems might also exist in the underlying VM's regex implementation that evaluates regex groups, though those might be harder to guard.
Because we do our own pattern parsing and evaluation (except regex groups), we have some flexibility in how to handle this:
URLPattern itself may also have ReDoS vulnerabilities. It would be best if our mitigations matched what implementors do.
We should: