Fix quadratic parsing of leading whitespace - #50
Open
theRizwan wants to merge 1 commit into
Open
Conversation
`geckoRe` and `javaScriptCoreRe` began with `^\s*` followed immediately by
a group that also matches whitespace — `(.*?)` and `([^@]*)` respectively.
A leading run of spaces could therefore be divided between the two in n
ways, and a line that did not match forced the engine through every split:
n= 1000 4.2 ms
n= 2000 14.6 ms
n= 4000 57.9 ms
n= 8000 231.3 ms
n=16000 924.0 ms
`err.stack` embeds the message, so attacker-influenced text reaches this
directly: a 30k-space message took ~3.3s of blocked event loop.
The leading `\s*` is redundant, since the following group already matches
whitespace. Its only real effect was keeping leading whitespace out of the
captured methodName, so that is handled where the capture is read.
After: 8000 -> 0.16ms, 16000 -> 0.37ms, 32000 -> 0.63ms, ~2x per doubling.
`chromeRe`, `winjsRe` and `nodeRe` are untouched: each has a literal `at `
after `^\s*`, which anchors the boundary and prevents the ambiguity.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #49.
parse()was quadratic in the length of a leading whitespace run, so a long run of spaces blockedthe event loop for seconds.
Before: ~4× per doubling. After: ~2×.
Cause
geckoReandjavaScriptCoreRebegan with^\s*followed immediately by a group that also matcheswhitespace —
(.*?)and([^@]*). A leading run of spaces could be divided between the two in nways, and a non-matching line forced the engine through every split.
chromeRe,winjsReandnodeReare untouched: each has a literalatright after^\s*, whichanchors the boundary and prevents the ambiguity.
Why it is worth fixing
err.stackembeds the message, so attacker-influenced text reaches the parser directly:Availability only — nothing is disclosed or corrupted — but a single request can stall a service
that parses stack traces from errors carrying user-supplied values.
The change
Dropping the leading
\s*is what makes the match linear. It was doing one useful thing, keepingleading whitespace out of the captured
methodName, so that moved to where the capture is read:Behaviour is unchanged — including the
UNKNOWN_FUNCTIONfallback, since an all-whitespace capturenow trims to
'', which is still falsy.I checked this rather than assumed it: removing
^\s*alone brokeparses JavaScriptCore errors,which expects
methodName: '_exampleFunction'and was getting' _exampleFunction'. The trimis what keeps that fixture green.
Tests
All 35 existing fixtures pass unchanged, and one timing test added.
Confirmed it catches the regression — on current
mainthe suite reports35 passing, 1 failingand takes 4 seconds; with the fix,
36 passingin 17 ms.The threshold is deliberately loose (8× headroom plus 100 ms) so it will not flake on a slow or noisy
CI machine, while still failing decisively on the quadratic behaviour, which is ~16× for the same
input growth.