GHSA-5q95-hrpc-m3w3

Dashboard / Vulnerabilities / GHSA-5q95-hrpc-m3w3

GHSA-5q95-hrpc-m3w3

Summary: JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

Details: ### Summary The JLine3 `HISTORY_IGNORE` variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than `*` and `:` are passed through to the regex engine. A crafted value such as `(a+)+b` can cause catastrophic backtracking each time a command line is added to history, hanging the reader thread at high CPU. ### Details In `reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java`, `matchPatterns()` converts `HISTORY_IGNORE` into a regex: ```java for (int i = 0; i < patterns.length(); i++) { char ch = patterns.charAt(i); if (ch == '\\') { ch = patterns.charAt(++i); sb.append(ch); } else if (ch == ':') { sb.append('|'); } else if (ch == '*') { sb.append('.').append('*'); } else { sb.append(ch); } } return line.matches(sb.toString()); ``` This logic translates wildcard syntax but does not escape regex metacharacters such as `(`, `)`, `+`, `?`, `{`, `}`, `[`, and `]`. Those characters therefore reach the Java regex engine unchanged. Affected source location: - `reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java` - `matchPatterns(String patterns, String line)` ### PoC 1. Configure `HISTORY_IGNORE` to a malicious pattern, for example: ```sh set history-ignore "(a+)+b" ``` 2. At the JLine prompt, enter a long non-matching line: ```text aaaaaaaaaaaaaaaaaaaaaaaaaaax ``` 3. Press Enter. Expected result: - The prompt does not return. - The reader thread consumes high CPU. Reproduction environment: - JLine3 on x86_64 Linux - OpenJDK 25.0.2 ### Impact This is a denial-of-service vulnerability caused by catastrophic regex backtracking. Applications embedding `org.jline:jline-reader` are impacted if they allow `HISTORY_IGNORE` to be configured through user configuration or application settings. The issue is lower severity than the interactive editor findings because the attacker must control configuration, but it can still reliably hang a reader session. ### Suggested Fix The safest fix for the current git head is to stop treating arbitrary `HISTORY_IGNORE` content as a regex. Instead, escape all characters by default and translate only the intended JLine wildcard syntax (`*`) and separator syntax (`:`). Suggested patch: ```diff diff --git a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java --- a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java +++ b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java @@ StringBuilder sb = new StringBuilder(); for (int i = 0; i < patterns.length(); i++) { char ch = patterns.charAt(i); if (ch == '\\') { ch = patterns.charAt(++i); - sb.append(ch); + sb.append(Pattern.quote(Character.toString(ch))); } else if (ch == ':') { sb.append('|'); } else if (ch == '*') { sb.append('.').append('*'); } else { - sb.append(ch); + sb.append(Pattern.quote(Character.toString(ch))); } } return line.matches(sb.toString()); ``` ### Credits This issue was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.

References: https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3, https://github.com/jline/jline3/pull/2012, https://github.com/jline/jline3/pull/2018, https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541, https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae, https://github.com/jline/jline3, https://github.com/jline/jline3/releases/tag/4.3.1, https://github.com/jline/jline3/releases/tag/jline-3.30.15