Add getShorthandValues ReDoS mitigation

ckeditor · Aug 21, 2024 · d829a01 · d829a01
1 parent 01b9275
commit d829a01
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/packages/ckeditor5-engine/src/view/styles/utils.ts b/packages/ckeditor5-engine/src/view/styles/utils.ts
@@ -7,6 +7,7 @@
  * @module engine/view/styles/utils
  */
 
+import { CKEditorError } from '@ckeditor/ckeditor5-utils';
 import type { BoxSides, PropertyDescriptor, StyleValue } from '../stylesmap.js';
 
 const HEX_COLOR_REGEXP = /^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/i;
@@ -253,6 +254,16 @@ export function getPositionShorthandNormalizer( shorthand: string ) {
  * ```
  */
 export function getShorthandValues( string: string ): Array<string> {
+	if ( string.length > 500 ) {
+		/**
+		 * Error thrown when the value of a CSS shorthand property is too long.
+		 * It's mitigation against potential reDoS attacks.
+		 *
+		 * @error css-shorthand-string-too-long
+		 */
+		throw new CKEditorError( 'css-shorthand-string-too-long', { string } );
+	}
+
 	const matches = string.matchAll( CSS_SHORTHAND_VALUE_REGEXP );
 
 	return Array.from( matches ).map( i => i[ 0 ] );

diff --git a/packages/ckeditor5-engine/tests/view/styles/utils.js b/packages/ckeditor5-engine/tests/view/styles/utils.js
@@ -3,6 +3,7 @@
  * For licensing, see LICENSE.md or https://ckeditor.com/legal/ckeditor-oss-license
  */
 
+import { CKEditorError } from '@ckeditor/ckeditor5-utils';
 import {
 	getBoxSidesShorthandValue,
 	getBoxSidesValues,
@@ -299,6 +300,13 @@ describe( 'Styles utils', () => {
 			expect( getShorthandValues( 'foo bar' ) ).to.deep.equal( [ 'foo', 'bar' ] );
 		} );
 
+		it( 'should raise exception when passed string is longer than 500 characters', () => {
+			expect( () => getShorthandValues( 'a'.repeat( 501 ) ) ).to.throw(
+				CKEditorError,
+				'css-shorthand-string-too-long'
+			);
+		} );
+
 		it( 'should split string to separate values when value contain grouping parens', () => {
 			expect( getShorthandValues( 'foo bar(1, 3, 5) url("example.com:foo/bar?q=b")' ) )
 				.to.deep.equal( [ 'foo', 'bar(1, 3, 5)', 'url("example.com:foo/bar?q=b")' ] );