Issue with Js sanitizer

[ihevcuk]

Script fails on js sanitizer with following exception: java.lang.RuntimeException: delight.nashornsandbox.exceptions.ScriptCPUAbuseException: Regular expression running for too many iterations. The operation could NOT be gracefully interrupted.

After that error, even the simplest script will fail with thread interrupted exception. On second call everything is fine.

I'm using java 17 and sandbox version 0.3.2. On version 0.3.0 it works as expected.

[mxro]

Thank you for raising this issue!

Could you provide a code example to help reproduce the issue? Are there any regular expressions in the code that is run by the sandbox?

[jpimag]

Hello,
I reproduce the same issue with version 0.4.2 and both jdk 17 or 21.
It happens with ugly client script using very long if else statement.

An exemple :

public class NashornSandboxBug {
	public static void main(String[] args) throws ScriptException {
		String s = """
				function(data) {
				  if (data.get("propertyA") == "a special value 1" || data.get("propertyA") == "a special value 2") {
				    return "a special value 1";
				  } else if (data.get("propertyB") == "a special value 3" && (data.get("propertyC") == "a special value 1" || data.get("propertyJ") == "a special value 1" || data.get("propertyV") == "a special value 1")) {
				    return "a special value 1";
				  } else if (data.get("propertyB") == "4" && (data.get("propertyD") == "a special value 1" || data.get("propertyV") == "a special value 1" || data.get("propertyW") == "a special value 1")) {
				    return "a special value 1";
				  } else if (data.get("propertyB") == "a special value 2" && (data.get("propertyE") == "a special value 1" || data.get("propertyF") == "a special value 1" || data.get("propertyL") == "a special value 1")) {
				    return "a special value 1";
				  } else if (data.get("propertyB") == "a special value 3" && (data.get("propertyE") == "a special value 1" || data.get("propertyF") == "a special value 1" || data.get("propertyL") == "a special value 1")) {
				    return "a special value 1";
				  } else if (data.get("propertyB") == "a special value 3" && (data.get("propertyM") == "a special value 1" || data.get("propertyY") == "a special value 1" || data.get("propertyH") == "a special value 1")) {
				    return "a special value 1";
				  } else if (data.get("propertyB") == "a special value 3" && (data.get("propertyM") == "a special value 1" || data.get("propertyY") == "a special value 1" || data.get("propertyH") == "a special value 1")) {
				    return "a special value 1";
				  } else if (data.get("propertyB") == "a special value 3" && (data.get("propertyM") == "a special value 1" || data.get("propertyY") == "a special value 1" || data.get("propertyH") == "a special value 1")) {
				    return "a special value 1";
				  } else if (data.get("propertyB") == "a special value 3" && (data.get("propertyM") == "a special value 1" || data.get("propertyY") == "a special value 1" || data.get("propertyH") == "a special value 1")) {
				    return "a special value 1";
				  } else if (data.get("propertyB") == "a special value 3" && (data.get("propertyM") == "a special value 1" || data.get("propertyY") == "a special value 1" || data.get("propertyH") == "a special value 1")) {
				    return "a special value 1";
				  }  else if (data.get("propertyB") == "a special value 3" && (data.get("propertyM") == "a special value 1" || data.get("propertyY") == "a special value 1" || data.get("propertyH") == "a special value 1")) {
				    return "a special value 1";
				  } else if (data.get("propertyB") == "a special value 3" && (data.get("propertyM") == "a special value 1" || data.get("propertyY") == "a special value 1" || data.get("propertyH") == "a special value 1")) {
				    return "a special value 1";
				  } else {
				     return "0"
				  };
				
				}
				""";
		NashornSandbox sandbox = NashornSandboxes.create();
		sandbox.eval(s);
	}
}

and the stacktrace :

Exception in thread "main" delight.nashornsandbox.exceptions.ScriptCPUAbuseException: Regular expression running for too many iterations. The operation could NOT be gracefully interrupted.
	at delight.nashornsandbox.internal.SecureInterruptibleCharSequence.charAt(SecureInterruptibleCharSequence.java:23)
	at java.base/java.lang.Character.codePointAt(Character.java:9320)
	at java.base/java.util.regex.Pattern$CharPropertyGreedy.match(Pattern.java:4453)
	at java.base/java.util.regex.Pattern$GroupHead.match(Pattern.java:4969)
	at java.base/java.util.regex.Pattern$Loop.match(Pattern.java:5057)
	at java.base/java.util.regex.Pattern$GroupTail.match(Pattern.java:5000)
	at java.base/java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:4134)
	at java.base/java.util.regex.Pattern$CharPropertyGreedy.match(Pattern.java:4470)
	at java.base/java.util.regex.Pattern$GroupHead.match(Pattern.java:4969)
	at java.base/java.util.regex.Pattern$Loop.match(Pattern.java:5057)
	at java.base/java.util.regex.Pattern$GroupTail.match(Pattern.java:5000)
	at java.base/java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:4134)
	at java.base/java.util.regex.Pattern$CharPropertyGreedy.match(Pattern.java:4470)
	at java.base/java.util.regex.Pattern$GroupHead.match(Pattern.java:4969)
	at java.base/java.util.regex.Pattern$Loop.match(Pattern.java:5057)
	at java.base/java.util.regex.Pattern$GroupTail.match(Pattern.java:5000)
	at java.base/java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:4134)
	at java.base/java.util.regex.Pattern$CharPropertyGreedy.match(Pattern.java:4470)
	at java.base/java.util.regex.Pattern$GroupHead.match(Pattern.java:4969)
	at java.base/java.util.regex.Pattern$Loop.match(Pattern.java:5057)
	at java.base/java.util.regex.Pattern$GroupTail.match(Pattern.java:5000)
	at java.base/java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:4134)
	at java.base/java.util.regex.Pattern$CharPropertyGreedy.match(Pattern.java:4470)
	at java.base/java.util.regex.Pattern$GroupHead.match(Pattern.java:4969)
	at java.base/java.util.regex.Pattern$Loop.match(Pattern.java:5057)
	at java.base/java.util.regex.Pattern$GroupTail.match(Pattern.java:5000)
	at java.base/java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:4134)
	at java.base/java.util.regex.Pattern$CharPropertyGreedy.match(Pattern.java:4470)
	at java.base/java.util.regex.Pattern$GroupHead.match(Pattern.java:4969)
	at java.base/java.util.regex.Pattern$Loop.match(Pattern.java:5057)
	at java.base/java.util.regex.Pattern$GroupTail.match(Pattern.java:5000)
	at java.base/java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:4134)
	at java.base/java.util.regex.Pattern$CharPropertyGreedy.match(Pattern.java:4470)
	at java.base/java.util.regex.Pattern$GroupHead.match(Pattern.java:4969)
	at java.base/java.util.regex.Pattern$Loop.matchInit(Pattern.java:5100)
	at java.base/java.util.regex.Pattern$Prolog.match(Pattern.java:5024)
	at java.base/java.util.regex.Pattern$GroupHead.match(Pattern.java:4969)
	at java.base/java.util.regex.Pattern$StartS.match(Pattern.java:3820)
	at java.base/java.util.regex.Matcher.search(Matcher.java:1767)
	at java.base/java.util.regex.Matcher.find(Matcher.java:787)
	at delight.nashornsandbox.internal.JsSanitizer.injectInterruptionCalls(JsSanitizer.java:236)
	at delight.nashornsandbox.internal.JsSanitizer.secureJsImpl(JsSanitizer.java:284)
	at delight.nashornsandbox.internal.JsSanitizer.secureJs(JsSanitizer.java:263)
	at delight.nashornsandbox.internal.NashornSandboxImpl.eval(NashornSandboxImpl.java:251)
	at delight.nashornsandbox.internal.NashornSandboxImpl.eval(NashornSandboxImpl.java:228)
	at com.eloquant.jp.blackhole.NashornSandboxBug.main(NashornSandboxBug.java:43)

Thanks