fix(security): guard subscription/message regex filters against ReDoS (#10185)

Filter patterns (subscription subFilter, policy-group Filter, message
MsgFilter) accept arbitrary user input while the tested text (remarks
from subscriptions, log lines) is attacker-influenced. Regex.IsMatch
without timeout hangs on evil patterns like (a+)+$ - a malicious
subscription can freeze the UI/log pipeline on every update.

Add Utils.IsRegexMatch with a 2s timeout; fail open (match) with a log
so no node or message is silently dropped. Apply to all four call
sites.

Co-authored-by: sdhfsl <sdhfsl@users.noreply.github.com>
This commit is contained in:
sdhfsl
2026-09-19 10:54:23 +08:00
committed by GitHub
parent bdd0ee1620
commit 05901b5673
5 changed files with 74 additions and 4 deletions
@@ -119,7 +119,7 @@ public class GroupProfileManager
p != null &&
p.IsValid() &&
(!p.ConfigType.IsComplexType() || p.ConfigType == EConfigType.Outbound) &&
(extra.Filter.IsNullOrEmpty() || Regex.IsMatch(p.Remarks, extra.Filter))
Utils.IsRegexMatch(p.Remarks, extra.Filter)
)
.ToList() ?? [];
}