Re: Re: CVE Request - roundcubemail

["Steven M. Christey" <coley () linus mitre org>]

On Wed, 17 Dec 2008, Florian Weimer wrote:

> > I bet there's a chunk of these in various applications.  I believe Perl
> > has similar functionality.
>
> Not quite, the s///e operator uses a compile-time transformation for
> the replacement expression, so it shouldn't be affected by this very
> issue.
>
> \Q \E pairs are an issue in the pattern, not the replacement.
> Mistakes in this area increase the attack surface by exposing the
> regular expression compiler to potentially hostile input, and it may
> lead to denial-of-service vulnerabilities because some implementations
> do not cope well with certain patterns.  Perhaps CWE-624 should be
> split to reflect this?

We'll take a closer look at it.

I'm not exactly sure what you're saying here, though.  Do you mean that if
attackers can insert a \Q or \E into the pattern, then they might be able
to effectively modify the pattern in unexpected ways?  I could imagine how
inserting a \E followed by something like "." would change the meaning of
the regexp.

- Steve