Jira (PUP-11213) Puppet/Puppetserver can be taken out by bad regex

[Alexander Fisher (Jira)]

Title: Message Title

Alexander Fisher created an issue   Puppet / PUP-11213 Puppet/Puppetserver can be taken out by bad regex Issue Type: Bug Affects Versions: PUP 7.9.0, PUP 6.24.0 Assignee: Unassigned Components: Compiler Created: 2021/08/20 5:14 AM Priority: Normal Reporter: Alexander Fisher Puppet Version: 6.24.0 7.10.0 Puppet Server Version: N/A OS Name/Version: N/A A 'Runaway Regular _expression_' in a single host's manifests can denial of service all your puppetservers. Desired Behavior: Puppet to detect that parsing a regex will take forever and fail the compilation. Actual Behavior: **Puppet compilation never finishes and puppetservers become unavailable.   The issue can be reproduced with 'puppet apply' eg. puppet apply -t -e 'assert_type(Pattern[/\A-----BEGIN PGP PRIVATE KEY BLOCK-----\n(.*\n?)+-----END PGP PRIVATE KEY BLOCK-----\Z/], "-----BEGIN PGP PRIVATE KEY BLOCK-----\nfoo\n-----END PGP PRIVATE KEY BLOCK-----")' The above command will never exit (given an actual key and not just 'foo' I suspect the heat death of the universe might occur first!). In the context of puppetserver, the jruby process is never returned to the pool.  Eventually, all jruby processes across all puppetservers are taken up and all other requests fail with "Attempt to borrow a JRubyInstance from the pool timed out" errors.   https://www.sysbee.net/blog/sysbee-blog/puppet-timeouts/ describes the same issue (but in that case, the regex was just very very slow, but did eventually parse). Some online regex testing tools see the issue and refuse to parse the regex. eg. "Rubular suspects this regex will take forever to parse. Regexes of this sort make Rubular sad." Add Comment   This message was sent by Atlassian Jira (v8.13.2#813002-sha1:c495a97) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.412818.1629461682000.112857.1629461700119%40Atlassian.JIRA.