🔒 Fix exponential ReDoS vulnerability in chmod_777 regex#86
🔒 Fix exponential ReDoS vulnerability in chmod_777 regex#86google-labs-jules[bot] wants to merge 1 commit into
Conversation
Restructured the regex in `hooks/security_guard.py` to eliminate overlapping capture groups. Changed from `chmod\s+(-[a-zA-Z]+\s+)*777\b` to `chmod(?:\s+-[a-zA-Z]+)*\s+777\b`. This avoids exponential backtracking by ensuring spaces are strictly bound before tokens rather than relying on a nested whitespace trailing within a repeating block. All tests pass with no functionality regressions.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
🎯 What: The
⚠️ Risk: If evaluated against a long, malicious payload (e.g.
chmod_777regex inhooks/security_guard.pycontained an overlapping nested quantifier that caused exponential backtracking (ReDoS).chmod -a -a ...), the script could hang indefinitely, leading to a Denial of Service.🛡️ Solution: Restructured the regex to
chmod(?:\s+-[a-zA-Z]+)*\s+777\bto eliminate the nested quantifier structure and avoid overlapping matching paths. Verified with existing tests.PR created automatically by Jules for task 2538270592116040089 started by @zknpr