fix(web_core): mitigate ReDoS vulnerability in regex validation function by Varun-S10 · Pull Request #2366 · a2ui-project/a2ui

Varun-S10 · 2026-08-21T08:32:28Z

Description

This PR fixes a bug where bad regular expression patterns would freeze and crash the browser (ReDoS issue).

Why this change is needed:

When a user types into an input field (like TextField), A2UI runs regex validation on every keystroke. Previously, if a regex pattern had nested repetitions (like (a+)+b), the browser's JavaScript engine would get stuck in an endless loop trying to match the text. This blocked the main thread and caused the entire web page to freeze.

What this PR does:

Adds Regex Safety Checker (safe_regex.ts):
- Checks regex patterns before running them.
- Automatically blocks dangerous patterns that cause infinite loops/freezes.
- Still allows all normal form patterns (email, phone, dates, zip codes, URLs).
Protects Function Execution (basic_functions.ts):
- Rejects unsafe regex patterns immediately instead of letting them freeze the browser.
Adds Size Limits (basic_functions_api.ts):
- Limits regex pattern length to 256 characters and input value to 4096 characters to prevent oversized inputs.
Protects React TextField (TextField.tsx):
- Checks the regex safely before testing user input.
Adds Tests:
- Added unit tests to make sure dangerous patterns are blocked and standard patterns work properly.

Results:

Dangerous Patterns: Blocked instantly in less than 0.2ms (no more browser freezes).
Normal Patterns: Email, phone, date, and text validations continue working 100% as expected.

Fixes #2292

Pre-launch Checklist

One time:

I signed the CLA.
I read the Contributors Guide.
I read the Style Guide.
I have built and run at least one sample.

For this PR:

I have updated the relevant CHANGELOG.md file.
I updated/added relevant documentation.
My code changes (if any) have tests.
If my branch is on a fork, I have verified that scripts/e2e_test.sh passes.

If you need help, consider asking for advice on the discussion board.

gemini-code-assist

Code Review

This pull request introduces a static analysis mechanism (isSafeRegex) to protect against catastrophic backtracking (ReDoS) vulnerabilities in regular expression patterns, integrating it into the React TextField component and the core regex validation function. The code reviewer identified several critical security issues and logic bugs in the newly added safe_regex.ts file. These include a failure to parse the wildcard character . correctly (treating it as a literal), a parser backtracking bug in parseQuantifier when handling invalid quantifiers, and a logic error in hasDisjointSeparator that incorrectly excludes elements from safety checks, potentially allowing unsafe patterns to bypass validation.

gemini-code-assist · 2026-08-21T08:35:40Z

+      } else if (char === '^' || char === '$') {
+        i++;
+        elements.push({type: 'Anchor', value: char});
+      } else {
+        const lit = pattern[i];
+        i++;
+        const litNode: LiteralNode = {
+          type: 'Literal',
+          value: lit,
+          quantifier: null,
+        };
+        parseQuantifier(litNode);
+        elements.push(litNode);
+      }


The wildcard character . is currently parsed as a literal character . instead of a wildcard matching any character. This leads to severe false negatives where dangerous patterns like (a|.)+ are incorrectly classified as safe.

We should parse . as a special EscapeNode with value '.' so that it can be handled as a wildcard in subsequent safety checks.

} else if (char === '^' || char === '$') { i++; elements.push({type: 'Anchor', value: char}); } else if (char === '.') { i++; const dotNode: EscapeNode = { type: 'Escape', value: '.', quantifier: null, }; parseQuantifier(dotNode); elements.push(dotNode); } else { const lit = pattern[i]; i++; const litNode: LiteralNode = { type: 'Literal', value: lit, quantifier: null, }; parseQuantifier(litNode); elements.push(litNode); }

Updated the AST parser to parse . as an EscapeNode with value '.' so it is properly recognized as a wildcard.

gemini-code-assist · 2026-08-21T08:35:40Z

+  if (node.type === 'Escape') {
+    if (node.value === 'd' && /^[0-9]$/.test(char)) return true;
+    if (node.value === 'w' && /^[a-zA-Z0-9_]$/.test(char)) return true;
+    if (node.value === 's' && /^\s$/.test(char)) return true;
+    return node.value === char;
+  }


Update nodeMatchesChar to treat the parsed wildcard . as matching any character.

Suggested change

if (node.type === 'Escape') {

if (node.value === 'd' && /^[0-9]$/.test(char)) return true;

if (node.value === 'w' && /^[a-zA-Z0-9_]$/.test(char)) return true;

if (node.value === 's' && /^\s$/.test(char)) return true;

return node.value === char;

}

if (node.type === 'Escape') {

if (node.value === '.') return true;

if (node.value === 'd' && /^[0-9]$/.test(char)) return true;

if (node.value === 'w' && /^[a-zA-Z0-9_]$/.test(char)) return true;

if (node.value === 's' && /^\\s$/.test(char)) return true;

return node.value === char;

}

Updated nodeMatchesChar to treat node.value === '.' as matching any character.

gemini-code-assist · 2026-08-21T08:35:40Z

+  const s1 = getFirstCharSummary(b1);
+  const s2 = getFirstCharSummary(b2);
+
+  if (s1.any || s2.any) return true;


Update branchesOverlap to ensure that any branch starting with a wildcard . is considered to overlap with any other branch.

if (s1.any || s2.any) return true; if (s1.escape === '.' || s2.escape === '.') return true;

Applied. Added the check so any branch with a wildcard . is marked as overlapping.

gemini-code-assist · 2026-08-21T08:35:40Z

+      if (i < pattern.length && pattern[i] === '}') {
+        i++;
+        quant = {
+          raw: pattern.slice(start, i),
+          min: isNaN(min) ? 1 : min,
+          max: isNaN(max) ? Infinity : max,
+          lazy: false,
+        };
+      }


In parseQuantifier, if the closing brace } is missing or if the quantifier is invalid (e.g., {invalid}), the parser does not backtrack i to start. This causes the parser to skip those characters entirely from being parsed as literals, and can even incorrectly treat invalid patterns as valid quantifiers.

We should validate that both min and max are valid numbers, and if not (or if the closing } is missing), backtrack i to start so the characters can be parsed as literals.

if (i < pattern.length && pattern[i] === '}') { i++; if (!isNaN(min) && !isNaN(max)) { quant = { raw: pattern.slice(start, i), min, max, lazy: false, }; } else { i = start; } } else { i = start; }

Fixed. Added index backtracking (i = start) when the quantifier range is invalid or when the closing brace } is missing.

gemini-code-assist · 2026-08-21T08:35:40Z

+    for (const el of branch.elements) {
+      if (el !== first && el !== last && 'quantifier' in el && el.quantifier) {
+        if (nodeMatchesChar(el, sep)) {
+          return false;
+        }
+      }
+    }


In hasDisjointSeparator, the loop excludes both first and last elements from being checked against the separator:

if (el !== first && el !== last && ...)

However, if first is the separator (e.g., in ,[a-z]+), then last is the quantified element and MUST be checked to ensure it does not match the separator. Excluding last from the check allows unsafe patterns like (aa+)* to bypass the ReDoS safety check.

We should only exclude the actual separator element (sepEl) from the check.

const sepEl = firstIsSep ? first : last; for (const el of branch.elements) { if (el !== sepEl && 'quantifier' in el && el.quantifier) { if (nodeMatchesChar(el, sep)) { return false; } } }

Updated the loop to only exclude the actual separator element sepEl, ensuring non-disjoint repeated patterns like (aa+)* are properly checked and rejected.

…ion (fixes a2ui-project#2292)

Varun-S10 · 2026-09-03T12:57:06Z

Hi @gspencergoog, could you please review this PR? It fixes #2292 by adding safe regex validation to prevent ReDoS freezes and UI lockups. I have also merged the latest changes from main.

gspencergoog · 2026-09-03T17:17:11Z

+ * @param options Configuration options including maximum pattern length.
+ * @returns `true` if the regex pattern is safe to execute on the client main thread; `false` otherwise.
+ */
+export function isSafeRegex(pattern: string, options?: SafeRegexOptions): boolean {


This is a lot of code to maintain. Are you sure that a regex validator doesn't already exist?

For example: https://github.com/tjenkinson/redos-detector

Thank you for the suggestion, @gspencergoog. I have removed the custom regex parser in safe_regex.ts (~580 lines) and replaced it with redos-detector (isSafePattern). All existing unit tests for safe and unsafe ReDoS patterns are passing.

github-project-automation Bot added this to A2UI Aug 21, 2026

github-project-automation Bot moved this to Todo in A2UI Aug 21, 2026

gemini-code-assist Bot reviewed Aug 21, 2026

View reviewed changes

Varun-S10 added the status: needs review label Aug 21, 2026

Varun-S10 added 2 commits August 26, 2026 18:27

fix(web_core): mitigate ReDoS vulnerability in regex validation funct…

7a39f0f

…ion (fixes a2ui-project#2292)

fix(web_core): address bot review suggestions for safe regex parser

06287e4

Varun-S10 force-pushed the fix/issue-2292 branch from 4ff6d1c to 06287e4 Compare August 26, 2026 13:13

Merge branch 'main' into fix/issue-2292

4b0bed0

gspencergoog reviewed Sep 3, 2026

View reviewed changes

Varun-S10 added 3 commits September 14, 2026 15:42

Merge remote-tracking branch 'upstream/main' into fix/issue-2292

8a83a15

Merge remote-tracking branch 'upstream/main' into fix/issue-2292

1b37e78

refactor(web_core): replace custom regex parser with redos-detector

49ccd2f

Conversation

Varun-S10 commented Aug 21, 2026

Description

Why this change is needed:

What this PR does:

Results:

Pre-launch Checklist

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

Varun-S10 Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

Varun-S10 Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

Varun-S10 Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

Varun-S10 Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

Varun-S10 Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

Varun-S10 commented Sep 3, 2026

Uh oh!

gspencergoog Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Varun-S10 Sep 23, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants