Headline
CVE-2023-43646: Merge pull request from GHSA-4q6p-r6v2-jvc5 · chaijs/get-func-name@f934b22
get-func-name is a module to retrieve a function’s name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t’.repeat(54773) + '\t/function/i’. This issue has been addressed in commit f934b228b which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Expand Up
@@ -13,6 +13,7 @@
const { toString } = Function.prototype;
const functionNameMatch = /\s*function(?:\s|\s*\/\*[^(?:*/)]+\*\/\s*)*([^\s(/]+)/;
const maxFunctionSourceLength = 512;
function getFuncName(aFunc) {
if (typeof aFunc !== ‘function’) {
return null;
Expand All
@@ -22,6 +23,12 @@ function getFuncName(aFunc) {
if (typeof Function.prototype.name === ‘undefined’ && typeof aFunc.name === ‘undefined’) {
// Here we run a polyfill if Function does not support the `name` property and if aFunc.name is not defined
// eslint-disable-next-line prefer-reflect
const functionSource = toString.call(aFunc);
// To avoid unconstrained resource consumption due to pathalogically large function names,
// we limit the available return value to be less than 512 characters.
if (functionSource.indexOf('(') > maxFunctionSourceLength) {
return name;
}
const match = toString.call(aFunc).match(functionNameMatch);
if (match) {
[ name ] = match;
Expand Down
Related news
Red Hat Security Advisory 2024-4591-03 - Updated images that include numerous enhancements, security, and bug fixes are now available for Red Hat OpenShift Data Foundation 4.16.0 on Red Hat Enterprise Linux 9. Issues addressed include denial of service, memory leak, and resource exhaustion vulnerabilities.
The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks. The regex implementation in question is as follows: ```js const functionNameMatch = /\s*function(?:\s|\s*\/\*[^(?:*/)]+\*\/\s*)*([^\s(/]+)/; ``` This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: ```js '\t'.repeat(54773) + '\t/function/i' ``` Here is a simple PoC code to demonstrate the issue: ```js const protocolre = /\sfunction(?:\s|\s/*[^(?:*\/)]+*/\s*)*([^\(\/]+)/; const startTime = Date.now(); const maliciousInput = '\t'.repeat(54773) + '\t/function/i' protocolre.test(maliciousInput); const endTime = Date.now(); console.log("process time: ", endTime - startTime, "ms"); ```