Executive brief
get-func-name is a Node.js utility library used to extract function names in a cross-browser compatible way. A regular expression used internally to parse function source code is vulnerable to catastrophic backtracking, allowing an attacker to supply specially crafted input that causes excessive CPU consumption and application hangs.
Technical details
The vulnerability is a regular expression denial of service (ReDoS) affecting the function name extraction logic. The vulnerable regex pattern `/\s*function(?:\s|\s*\/\*[^(?:*/)]+\*\/\s*)*([^\s(/]+)/` uses nested quantifiers that can cause excessive backtracking when processing input with unbalanced parentheses or specific malformed patterns. An attacker can trigger this by sending input such as repeated tabs followed by `/function/i`, causing the regex engine to consume excessive CPU resources. The vulnerability exists in versions prior to 2.0.1, and the fix involves limiting the function source length examined (maxFunctionSourceLength = 512) to prevent unconstrained resource consumption. Network-accessible applications that use get-func-name and process untrusted input could experience denial of service.
Affected products
- Chaijs get-func-name <2.0.1
Timeline
- 2023-09-27: disclosed
- 2023-09-27: patched: Fixed in version 2.0.1