Fix potentially vulnerable cloned function - #1646
Conversation
📝 WalkthroughWalkthroughThe preprocessRFC2822 function's regex pattern for stripping RFC 2822 comment blocks is updated to better handle nested parentheses using dotAll and negative-lookahead syntax, while maintaining the same subsequent whitespace normalization. ChangesRFC 2822 Comment Regex Update
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@front/lib/moment/moment.js`:
- Around line 2295-2297: Update the incorrect CVE reference and document the
ReDoS fix for preprocessRFC2822: change any mention of CVE-2023-22467 to
CVE-2022-31129, and add a brief comment near the preprocessRFC2822 function
stating that the tempered greedy token regex (/\\((?:(?!\\().)*\\)|[\\n\\t]/gs
...) prevents catastrophic backtracking (O(n)) and that Moment.js versions
2.18.0 through 2.29.3 (including 2.24.0) were affected and this patch addresses
the vulnerability. Confirm the regex remains unchanged and functioning as the
intended safe fix.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2f39efaa-9199-46a0-9660-bdf6c6984d2f
📒 Files selected for processing (1)
front/lib/moment/moment.js
| function preprocessRFC2822(s) { | ||
| // Remove comments and folding whitespace and replace multiple-spaces with a single space | ||
| return s.replace(/\([^)]*\)|[\n\t]/g, ' ').replace(/(\s\s+)/g, ' ').replace(/^\s\s*/, '').replace(/\s\s*$/, ''); | ||
| return s.replace(/\((?:(?!\().)*\)|[\n\t]/gs, ' ').replace(/(\s\s+)/g, ' ').replace(/^\s\s*/, '').replace(/\s\s*$/, ''); |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Moment.js ReDoS vulnerability CVE preprocessRFC2822
💡 Result:
CVE-2022-31129 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Moment.js library [1][2][3]. It specifically affects the preprocessRFC2822 function, which is used to parse date strings [1][2][4]. The vulnerability arises because the regular expression used to strip legacy comments (content within parentheses) from date strings exhibits quadratic (O(n²)) complexity due to catastrophic backtracking [1][2]. When Moment.js is called with a user-supplied string and no explicit format is provided, it attempts RFC2822 parsing by default [1][2]. An attacker can exploit this by providing a specially crafted, long input string containing many consecutive opening parentheses, which can block the Node.js event loop and cause a denial-of-service condition [1][5][4]. The vulnerability affects Moment.js versions from 2.18.0 up to, but not including, 2.29.4 [4][3][6]. To mitigate this vulnerability: 1. Upgrade Moment.js to version 2.29.4 or later [1][2][4]. This version includes a patched regular expression that eliminates the quadratic complexity [1][2]. 2. If an immediate upgrade is not possible, implement input validation to reject or truncate user-supplied date strings to a safe length (e.g., 200 characters or fewer) before passing them to the Moment.js constructor [1][3][7]. 3. Always provide an explicit format string as the second argument when calling moment(input, format) to bypass the automatic RFC2822 parsing attempt [1].
Citations:
- 1: https://vulwall.dev/kb/moment-js-redos-cve-2022-31129-service-availability
- 2: https://www.sentinelone.com/vulnerability-database/cve-2022-31129/
- 3: https://nvd.nist.gov/vuln/detail/cve-2022-31129
- 4: https://security.snyk.io/vuln/SNYK-DOTNET-MOMENTJS-2944237
- 5: Regular Expression Denial of Service (ReDoS) moment/moment#6012
- 6: https://www.mend.io/vulnerability-database/CVE-2022-31129/
- 7: https://guide.sonatype.com/vulnerability/CVE-2022-31129
🏁 Script executed:
# Search for the upstream commit reference or related comments in the file
cd front/lib/moment && head -100 moment.js | grep -i "commit\|version\|github"Repository: netalertx/NetAlertX
Length of output: 45
🏁 Script executed:
# Check the git history of this specific file to see PR/commit messages
git log --oneline -20 front/lib/moment/moment.js 2>/dev/null | head -20Repository: netalertx/NetAlertX
Length of output: 141
🏁 Script executed:
# Get more details about the recent commit that fixed the ReDoS
git show 0517da24 --statRepository: netalertx/NetAlertX
Length of output: 50375
🏁 Script executed:
# Get the exact diff for just the moment.js file
git show 0517da24 -- front/lib/moment/moment.js | head -50Repository: netalertx/NetAlertX
Length of output: 1713
🏁 Script executed:
# Look for the preprocessRFC2822 function in the current file
sed -n '2295,2300p' front/lib/moment/moment.jsRepository: netalertx/NetAlertX
Length of output: 394
Correct CVE reference and confirm the ReDoS fix.
The regex pattern using the tempered greedy token (?:(?!\().)* is correct and safe—it prevents catastrophic backtracking by matching non-overlapping innermost comment blocks in O(n) time. However, the CVE reference is incorrect:
- CVE-2022-31129 (not CVE-2023-22467) is the actual Moment.js ReDoS vulnerability affecting preprocessRFC2822
- Moment.js versions 2.18.0 through 2.29.3 are vulnerable
- Version 2.24.0 in this repository is affected and this fix applies the correct patch
The change successfully addresses the vulnerability.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@front/lib/moment/moment.js` around lines 2295 - 2297, Update the incorrect
CVE reference and document the ReDoS fix for preprocessRFC2822: change any
mention of CVE-2023-22467 to CVE-2022-31129, and add a brief comment near the
preprocessRFC2822 function stating that the tempered greedy token regex
(/\\((?:(?!\\().)*\\)|[\\n\\t]/gs ...) prevents catastrophic backtracking (O(n))
and that Moment.js versions 2.18.0 through 2.29.3 (including 2.24.0) were
affected and this patch addresses the vulnerability. Confirm the regex remains
unchanged and functioning as the intended safe fix.
2 participants
Hi again,
Our tool identified a potential vulnerability in a clone function in
front/lib/moment/moment.jssourced from moment/moment. This issue, originally reported in CVE-2023-22467, was resolved in the repository via this commit moment/moment@bfd4f23.This PR suggests applying the corresponding patch to fix the vulnerabilities in this codebase.
Please review at your convenience. Thank you!
Summary by CodeRabbit