Skip to content

Commit 6b72a20

Browse files
SummerBootFrameworkSummerBootFramework
committed
fixed: Polynomial regular expression used on uncontrolled data
1 parent 4027bb5 commit 6b72a20

File tree

2 files changed

+63
-28
lines changed

2 files changed

+63
-28
lines changed

‎CHANGES

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
-- release 2.6.1
22
- enhanced security: replace secpr5121 with secp256r1 for default ECGenParameterSpec
3+
- enhanced security: Use of a cryptographic algorithm with insufficient key size - Throw InvalidAlgorithmParameterException when use of a cryptographic algorithm with insufficient key size to call EncryptorUtil.generateKeyPair()
4+
- enhanced security: fixed polynomial regular expression used on uncontrolled data (FormatterUtil)
35
- enhanced logging: log detailed information and stack trace health check failure
46
- enhanced logging: Netty channel handler exception will be logged only when:
57
1. run with -debug

‎src/main/java/org/summerboot/jexpress/util/FormatterUtil.java

Lines changed: 61 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -73,43 +73,72 @@ public static String[] parseLines(String txt) {
7373
return StringUtils.isBlank(txt) ? EMPTY_STR_ARRAY : txt.split("\\r?\\n");
7474
}
7575

76-
public static String[] parseDsv(String csv, String delimiter) {
77-
if (StringUtils.isBlank(delimiter) || ",".equals(delimiter)) {
78-
return parseCsv(csv);
76+
public static String[] parseDsv(String dsv, String delimiter) {
77+
return parseDsv(dsv, delimiter, true);
78+
}
79+
80+
public static String[] parseDsv(String dsv, String delimiter, boolean trim) {
81+
if (StringUtils.isBlank(dsv)) {
82+
return EMPTY_STR_ARRAY;
7983
}
80-
return StringUtils.isBlank(csv) ? EMPTY_STR_ARRAY : csv.trim().split("\\s*" + delimiter + "\\s*");
84+
85+
if (trim) {
86+
// Replace all consecutive spaces or delimiter characters with a single delimiter character
87+
dsv = dsv.trim().replaceAll("\\s*" + delimiter + "\\s*", delimiter);
88+
}
89+
// Use StringUtils.split, which does not use regular expressions
90+
return StringUtils.split(dsv, delimiter);
8191
}
8292

8393
public static String[] parsePsv(String psv) {
94+
return parsePsv(psv, true);
95+
}
96+
97+
public static String[] parsePsv(String psv, boolean trim) {
8498
//return StringUtils.isBlank(csv) ? EMPTY_STR_ARRAY : csv.trim().split(REGEX_PSV);
8599
if (StringUtils.isBlank(psv)) {
86100
return EMPTY_STR_ARRAY;
87101
}
88-
// Replace all consecutive spaces or target characters with a single target character
89-
//String cleanedPsv = psv.trim().replaceAll("[\\s|]+", "|");
102+
if (trim) {
103+
// Replace all consecutive spaces or delimiter characters with a single delimiter character
104+
psv = psv.trim().replaceAll("[\\s|]+", "|");
105+
}
90106
// Use StringUtils.split, which does not use regular expressions
91107
return StringUtils.split(psv, '|');
92108
}
93109

94110
public static String[] parseCsv(String csv) {
111+
return parseCsv(csv, true);
112+
}
113+
114+
public static String[] parseCsv(String csv, boolean trim) {
95115
//return StringUtils.isBlank(csv) ? EMPTY_STR_ARRAY : csv.trim().split(REGEX_CSV);
96-
return StringUtils.isBlank(csv) ? EMPTY_STR_ARRAY : StringUtils.split(csv);
116+
if (StringUtils.isBlank(csv)) {
117+
return EMPTY_STR_ARRAY;
118+
}
119+
//return StringUtils.isBlank(csv) ? EMPTY_STR_ARRAY : StringUtils.split(csv);
120+
if (trim) {
121+
// Replace all consecutive spaces or delimiter characters with a single delimiter character
122+
csv = csv.trim().replaceAll("\\s*,\\s*", ",");
123+
}
124+
// Use StringUtils.split, which does not use regular expressions
125+
return StringUtils.split(csv, ',');
97126
}
98127

99128
public static String[] parseURL(String url) {
129+
return parseURL(url, true);
130+
}
131+
132+
public static String[] parseURL(String url, boolean trim) {
100133
//return StringUtils.isBlank(url) ? EMPTY_STR_ARRAY : url.trim().split(REGEX_URL);
101134
if (StringUtils.isBlank(url)) {
102135
return EMPTY_STR_ARRAY;
103136
}
104-
// Replace all consecutive spaces or target characters with a single target character
105-
//String cleanedUrl = url.trim().replaceAll("\\s*/\\s*", "/");
106-
return StringUtils.split(url, "/ ");
107-
}
108-
109-
public static String[] parseURL(String url, boolean trim) {
110-
return StringUtils.isBlank(url)
111-
? EMPTY_STR_ARRAY
112-
: trim ? url.trim().split(REGEX_URL) : url.split(REGEX_URL);
137+
if (trim) {
138+
// Replace all consecutive spaces or delimiter characters with a single delimiter character
139+
url = url.trim().replaceAll("\\s*/\\s*", "/");
140+
}
141+
return StringUtils.split(url, '/');
113142
}
114143

115144
public static String parseUrlQueryParam(String url, Map<String, String> queryParam) {
@@ -253,24 +282,28 @@ public static String b2n(String s) {
253282
* BindAddresses = 192.168.1.10:8445, 127.0.0.1:8446, 0.0.0.0:8447
254283
*/
255284
public static Map<String, Integer> parseBindingAddresss(String bindAddresses) {
256-
//int[] ports = Arrays.stream(portsStr).mapToInt(Integer::parseInt).toArray();
257-
Map<String, Integer> ret = new HashMap<>();
258-
String[] addrs = parseCsv(bindAddresses);
259-
for (String addr : addrs) {
260-
//String[] ap = addr.trim().split(REGEX_BINDING_MAP);
261-
String[] ap = StringUtils.split(addr, ":");
262-
ret.put(ap[0], Integer.parseInt(ap[1]));
263-
}
264-
return ret;
285+
Map<String, String> stringMap = parseMap(bindAddresses, true);
286+
Map<String, Integer> integerMap = stringMap.entrySet().stream()
287+
.collect(Collectors.toMap(
288+
Map.Entry::getKey, // key remains the same
289+
entry -> Integer.valueOf(entry.getValue()) // convert value to Integer
290+
));
291+
return integerMap;
265292
}
266293

267294
public static Map<String, String> parseMap(String mapCVS) {
268-
//int[] ports = Arrays.stream(portsStr).mapToInt(Integer::parseInt).toArray();
295+
return parseMap(mapCVS, true);
296+
}
297+
298+
public static Map<String, String> parseMap(String mapCVS, boolean trim) {
269299
Map<String, String> ret = new HashMap<>();
270-
String[] mapKeyValues = parseCsv(mapCVS);
300+
String[] mapKeyValues = parseCsv(mapCVS, true);
271301
for (String mapKeyValue : mapKeyValues) {
272302
//String[] ap = mapKeyValue.trim().split(REGEX_BINDING_MAP);
273-
String[] ap = StringUtils.split(mapKeyValue, ":");
303+
if (trim) {
304+
mapKeyValue = mapKeyValue.trim().replaceAll("\\s*:\\s*", ":");
305+
}
306+
String[] ap = StringUtils.split(mapKeyValue, ':');
274307
ret.put(ap[0], ap[1]);
275308
}
276309
return ret;

0 commit comments

Comments
 (0)