{"action":"created","issue":{"url":"https://api.github.com/repos/zalando/nakadi/issues/853","repository_url":"https://api.github.com/repos/zalando/nakadi","labels_url":"https://api.github.com/repos/zalando/nakadi/issues/853/labels{/name}","comments_url":"https://api.github.com/repos/zalando/nakadi/issues/853/comments","events_url":"https://api.github.com/repos/zalando/nakadi/issues/853/events","html_url":"https://github.com/zalando/nakadi/pull/853","id":300826001,"number":853,"title":"ensure linear runtime regex pattern matching","user":{"login":"rkeytacked","id":25012935,"avatar_url":"https://avatars2.githubusercontent.com/u/25012935?v=4","gravatar_id":"","url":"https://api.github.com/users/rkeytacked","html_url":"https://github.com/rkeytacked","followers_url":"https://api.github.com/users/rkeytacked/followers","following_url":"https://api.github.com/users/rkeytacked/following{/other_user}","gists_url":"https://api.github.com/users/rkeytacked/gists{/gist_id}","starred_url":"https://api.github.com/users/rkeytacked/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rkeytacked/subscriptions","organizations_url":"https://api.github.com/users/rkeytacked/orgs","repos_url":"https://api.github.com/users/rkeytacked/repos","events_url":"https://api.github.com/users/rkeytacked/events{/privacy}","received_events_url":"https://api.github.com/users/rkeytacked/received_events","type":"User","site_admin":false},"labels":[{"id":272848285,"url":"https://api.github.com/repos/zalando/nakadi/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-02-27T22:58:51Z","updated_at":"2018-03-02T11:23:32Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/zalando/nakadi/pulls/853","html_url":"https://github.com/zalando/nakadi/pull/853","diff_url":"https://github.com/zalando/nakadi/pull/853.diff","patch_url":"https://github.com/zalando/nakadi/pull/853.patch"},"body":"There is exponential runtime behaviour in Java's PCRE regex lib. Hence there is a possible denial-of-service attack for Nakadi using particular regex patterns and values for json schema validation.\r\n\r\nOne added test case picks an example of such a bad-behaving regular expression and checks that schema validation happens within milliseconds. This is not met before.\r\n\r\nChanging json-schema to a current version fixes that runtime issue, because json-schema now internally uses `com.google.re2j.Pattern` instead of `java.util.regex.Pattern`. The RE2 engine guarantees linear runtime.\r\n\r\nThe json-schema version I've chosen is not a release version, but a particular commit, to proof that it works with Nakadi."},"comment":{"url":"https://api.github.com/repos/zalando/nakadi/issues/comments/369896190","html_url":"https://github.com/zalando/nakadi/pull/853#issuecomment-369896190","issue_url":"https://api.github.com/repos/zalando/nakadi/issues/853","id":369896190,"user":{"login":"rkeytacked","id":25012935,"avatar_url":"https://avatars2.githubusercontent.com/u/25012935?v=4","gravatar_id":"","url":"https://api.github.com/users/rkeytacked","html_url":"https://github.com/rkeytacked","followers_url":"https://api.github.com/users/rkeytacked/followers","following_url":"https://api.github.com/users/rkeytacked/following{/other_user}","gists_url":"https://api.github.com/users/rkeytacked/gists{/gist_id}","starred_url":"https://api.github.com/users/rkeytacked/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rkeytacked/subscriptions","organizations_url":"https://api.github.com/users/rkeytacked/orgs","repos_url":"https://api.github.com/users/rkeytacked/repos","events_url":"https://api.github.com/users/rkeytacked/events{/privacy}","received_events_url":"https://api.github.com/users/rkeytacked/received_events","type":"User","site_admin":false},"created_at":"2018-03-02T11:23:32Z","updated_at":"2018-03-02T11:23:32Z","author_association":"NONE","body":"like this, @lmontrieux ?"}}
{"actor":{"display_login":"rkeytacked"}}