Skip to content

Comments

esm: avoid super-linear data URL MIME regex#61951

Open
skdas20 wants to merge 2 commits intonodejs:mainfrom
skdas20:fix-61904-data-url-regex-backtracking
Open

esm: avoid super-linear data URL MIME regex#61951
skdas20 wants to merge 2 commits intonodejs:mainfrom
skdas20:fix-61904-data-url-regex-backtracking

Conversation

@skdas20
Copy link

@skdas20 skdas20 commented Feb 23, 2026

Fixes: #61904

This updates ESM data URL MIME extraction regexes to remove overlapping quantifiers that allow super-linear backtracking.

  • Replaced (?:[^,]*?)(;base64)?, with (?:;[^,]*)?, in:
    • lib/internal/modules/esm/get_format.js
    • lib/internal/modules/esm/load.js

Behavior is preserved for existing valid/invalid data: URL shapes while avoiding pathological backtracking on crafted inputs.

@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/loaders

@nodejs-github-bot nodejs-github-bot added esm Issues and PRs related to the ECMAScript Modules implementation. needs-ci PRs that need a full CI run. labels Feb 23, 2026
Copy link

@jsumners-nr jsumners-nr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where are tests to assert the undesired behavior is resolved by the changes?

@skdas20
Copy link
Author

skdas20 commented Feb 23, 2026

Added regression coverage in test/parallel/test-esm-data-url-format-regex-backtracking.js (commit 740d1320).

The test exercises defaultGetFormat() with a long malformed data: URL (data:a/aaaa...B) that used to trigger super-linear backtracking, and asserts the path now completes within a platform-adjusted bound.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

esm Issues and PRs related to the ECMAScript Modules implementation. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

non-linear back tracking in the regex used in getDataProtocolModuleFormat

3 participants