Executive brief
d3-color is a JavaScript library used to manipulate and convert between different color formats in web browsers and applications. A flaw in how it processes color strings allows an attacker to send specially crafted input that causes the system to slow down significantly or become unresponsive. This can lead to a denial-of-service condition, affecting the availability of the application for legitimate users.
Technical details
The d3-color library prior to version 3.1.0 is vulnerable to Regular Expression Denial of Service (ReDoS) within its color parsing logic, specifically affecting the rgb() and hsl() functions. The vulnerability is caused by an ambiguous regular expression used to match numeric values and percentages, which leads to catastrophic backtracking when processing certain malformed input strings. An attacker can exploit this by providing a crafted string (e.g., a long sequence of digits followed by an unexpected character) that triggers exponential processing time on the regex engine. This issue is fixed in version 3.1.0 by refactoring the regular expression to avoid overlapping optional groups.
Affected products
- d3 d3-color < 3.1.0
Timeline
- 2021-02-18: disclosed: Vulnerability first disclosed to Snyk
- 2022-03-28: patched: Fixed in version 3.1.0 via pull request #100
- 2022-09-29: advisory: GitHub Advisory published