Pattern evaluator and ReDOS

[ar-or]

It seems that the pattern and patternProperties are vulnerable to ReDos if the schema is user-provided.
A potential solution could be replacing regex evaluation with a linear evaluation engine

[harrel56]

Hi, thanks for taking interest in the project.

It seems that the pattern and patternProperties are vulnerable to ReDos if the schema is user-provided.

This is indeed true, but I'm afraid that generally allowing loading schemas from untrusted sources is a bad idea. Many projects might use file system or HTTP based schema resolution which is an obvious security concern. While this project does not provide such capabilities out of the box, I think the attack surface grows significantly if user-provided schemas are allowed.

As for the regex library - I don't think adding "safer" regex library would address the security concerns completely. And of course I want to keep it as lightweight as possible + standard java regex implementation would be far more familiar to the users. But if this is something you personally want to do in your setup/project: overriding pattern and patternProperties should be a fairly easy thing to do (https://harrel56.github.io/json-schema/evaluator-factories.html).

Still, warning users about such security concern might be a good idea. I will check where it would fit best.