fix quadratic backtracking in URIResultParser isPossiblyMaliciousURI (#2110)

1 files changed, 14 insertions, 0 deletions

diff --git a/core/src/test/java/com/google/zxing/client/result/URIParsedResultTestCase.java b/core/src/test/java/com/google/zxing/client/result/URIParsedResultTestCase.java
index 8b3dac1c0..dfc14909c 100644
--- a/core/src/test/java/com/google/zxing/client/result/URIParsedResultTestCase.java
+++ b/core/src/test/java/com/google/zxing/client/result/URIParsedResultTestCase.java
@@ -76,6 +76,18 @@ public final class URIParsedResultTestCase extends Assert {
     assertFalse(URIResultParser.isBasicallyValidURI(sb.toString()));
   }
 
+  // A scheme followed by a long run of ':' must be checked quickly; ':' is a member of the userinfo
+  // class, so the find() of the user-in-host regex backtracked quadratically on such input.
+  @Test(timeout = 5000L)
+  public void testNoQuadraticMaliciousScanning() {
+    StringBuilder sb = new StringBuilder(200007);
+    sb.append("http://");
+    for (int i = 0; i < 200000; i++) {
+      sb.append(':');
+    }
+    assertFalse(URIResultParser.isPossiblyMaliciousURI(sb.toString()));
+  }
+
   @Test
   public void testURLTO() {
     doTest("urlto::bar.com", "http://bar.com", null);
@@ -101,7 +113,9 @@ public final class URIParsedResultTestCase extends Assert {
     doTestIsPossiblyMalicious("https://google.com:443", false);
     doTestIsPossiblyMalicious("https://google.com:443/", false);
     doTestIsPossiblyMalicious("https://evil@google.com:443", true);
+    doTestIsPossiblyMalicious("http://user:pass@evil.com", true);
     doTestIsPossiblyMalicious("http://google.com/foo@bar", false);
+    doTestIsPossiblyMalicious("http://google.com:8080/path@x", false);
     doTestIsPossiblyMalicious("http://google.com/@@", false);
   }