terser 5.14.1 → 5.14.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## v5.14.2
+
+ - Security fix for RegExps that should not be evaluated (regexp DDOS)
+ - Source maps improvements (#1211)
+ - Performance improvements in long property access evaluation (#1213)
+
 ## v5.14.1
  - keep_numbers option added to TypeScript defs (#1208)
  - Fixed parsing of nested template strings (#1204)
@@ -206,6 +212,13 @@ Hotfix release, fixes package.json "engines" syntax
  - Module is now distributed as a dual package - You can `import` and `require()` too.
  - Inline improvements were made
 
+
+-----
+
+## v4.8.1 (backport)
+
+ - Security fix for RegExps that should not be evaluated (regexp DDOS)
+
 ## v4.8.0
 
  - Support for numeric separators (`million = 1_000_000`) was added.

package/dist/bundle.min.js

@@ -253,7 +253,15 @@ function regexp_source_fix(source) {
         return (escaped ? "" : "\\") + lineTerminatorEscape[match];
     });
 }
-const all_flags = "gimuy";
+
+// Subset of regexps that is not going to cause regexp based DDOS
+// https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
+const re_safe_regexp = /^[\\/|\0\s\w^$.[\]()]*$/;
+
+/** Check if the regexp is safe for Terser to create without risking a RegExp DOS */
+const regexp_is_safe = (source) => re_safe_regexp.test(source);
+
+const all_flags = "dgimsuy";
 function sort_regexp_flags(flags) {
     const existing_flags = new Set(flags.split(""));
     let out = "";
@@ -9640,12 +9648,14 @@ function OutputStream(options) {
         output.with_indent(output.next_indent(), function() {
             output.append_comments(self, true);
         });
+        output.add_mapping(self.end);
         output.print("}");
     }
     function print_braced(self, output, allow_directives) {
         if (self.body.length > 0) {
             output.with_block(function() {
                 display_body(self.body, false, output, allow_directives);
+                output.add_mapping(self.end);
             });
         } else print_braced_empty(self, output);
     }
@@ -13851,7 +13861,7 @@ def_eval(AST_BigInt, return_this);
 
 def_eval(AST_RegExp, function (compressor) {
     let evaluated = compressor.evaluated_regexps.get(this.value);
-    if (evaluated === undefined) {
+    if (evaluated === undefined && regexp_is_safe(this.value.source)) {
         try {
             const { source, flags } = this.value;
             evaluated = new RegExp(source, flags);
@@ -14064,7 +14074,7 @@ const regexp_flags = new Set([
 ]);
 
 def_eval(AST_PropAccess, function (compressor, depth) {
-    const obj = this.expression._eval(compressor, depth);
+    let obj = this.expression._eval(compressor, depth + 1);
     if (obj === nullish || (this.optional && obj == null)) return nullish;
     if (compressor.option("unsafe")) {
         var key = this.property;
@@ -14074,7 +14084,6 @@ def_eval(AST_PropAccess, function (compressor, depth) {
                 return this;
         }
         var exp = this.expression;
-        var val;
         if (is_undeclared_ref(exp)) {
 
             var aa;
@@ -14091,29 +14100,29 @@ def_eval(AST_PropAccess, function (compressor, depth) {
             }
             if (!is_pure_native_value(exp.name, key))
                 return this;
-            val = global_objs[exp.name];
+            obj = global_objs[exp.name];
         } else {
-            val = exp._eval(compressor, depth + 1);
-            if (val instanceof RegExp) {
+            if (obj instanceof RegExp) {
                 if (key == "source") {
-                    return regexp_source_fix(val.source);
+                    return regexp_source_fix(obj.source);
                 } else if (key == "flags" || regexp_flags.has(key)) {
-                    return val[key];
+                    return obj[key];
                 }
             }
-            if (!val || val === exp || !HOP(val, key))
+            if (!obj || obj === exp || !HOP(obj, key))
                 return this;
-            if (typeof val == "function")
+
+            if (typeof obj == "function")
                 switch (key) {
                     case "name":
-                        return val.node.name ? val.node.name.name : "";
+                        return obj.node.name ? obj.node.name.name : "";
                     case "length":
-                        return val.node.length_property();
+                        return obj.node.length_property();
                     default:
                         return this;
                 }
         }
-        return val[key];
+        return obj[key];
     }
     return this;
 });
@@ -18992,6 +19001,7 @@ def_optimize(AST_Call, function(self, compressor) {
                     params.push(value);
                     return arg !== value;
                 })
+                && regexp_is_safe(params[0])
             ) {
                 let [ source, flags ] = params;
                 source = regexp_source_fix(new RegExp(source).source);
@@ -20651,6 +20661,12 @@ def_optimize(AST_Dot, function(self, compressor) {
         const sub = self.flatten_object(self.property, compressor);
         if (sub) return sub.optimize(compressor);
     }
+
+    if (self.expression instanceof AST_PropAccess
+        && parent instanceof AST_PropAccess) {
+        return self;
+    }
+
     let ev = self.evaluate(compressor);
     if (ev !== self) {
         ev = make_node_from_constant(ev, self).optimize(compressor);

package/lib/compress/evaluate.js

@@ -46,7 +46,8 @@ import {
     makePredicate,
     return_this,
     string_template,
-    regexp_source_fix
+    regexp_source_fix,
+    regexp_is_safe,
 } from "../utils/index.js";
 import {
     AST_Array,
@@ -129,7 +130,7 @@ def_eval(AST_BigInt, return_this);
 
 def_eval(AST_RegExp, function (compressor) {
     let evaluated = compressor.evaluated_regexps.get(this.value);
-    if (evaluated === undefined) {
+    if (evaluated === undefined && regexp_is_safe(this.value.source)) {
         try {
             const { source, flags } = this.value;
             evaluated = new RegExp(source, flags);
@@ -342,7 +343,7 @@ const regexp_flags = new Set([
 ]);
 
 def_eval(AST_PropAccess, function (compressor, depth) {
-    const obj = this.expression._eval(compressor, depth);
+    let obj = this.expression._eval(compressor, depth + 1);
     if (obj === nullish || (this.optional && obj == null)) return nullish;
     if (compressor.option("unsafe")) {
         var key = this.property;
@@ -352,7 +353,6 @@ def_eval(AST_PropAccess, function (compressor, depth) {
                 return this;
         }
         var exp = this.expression;
-        var val;
         if (is_undeclared_ref(exp)) {
 
             var aa;
@@ -369,29 +369,29 @@ def_eval(AST_PropAccess, function (compressor, depth) {
             }
             if (!is_pure_native_value(exp.name, key))
                 return this;
-            val = global_objs[exp.name];
+            obj = global_objs[exp.name];
         } else {
-            val = exp._eval(compressor, depth + 1);
-            if (val instanceof RegExp) {
+            if (obj instanceof RegExp) {
                 if (key == "source") {
-                    return regexp_source_fix(val.source);
+                    return regexp_source_fix(obj.source);
                 } else if (key == "flags" || regexp_flags.has(key)) {
-                    return val[key];
+                    return obj[key];
                 }
             }
-            if (!val || val === exp || !HOP(val, key))
+            if (!obj || obj === exp || !HOP(obj, key))
                 return this;
-            if (typeof val == "function")
+
+            if (typeof obj == "function")
                 switch (key) {
                     case "name":
-                        return val.node.name ? val.node.name.name : "";
+                        return obj.node.name ? obj.node.name.name : "";
                     case "length":
-                        return val.node.length_property();
+                        return obj.node.length_property();
                     default:
                         return this;
                 }
         }
-        return val[key];
+        return obj[key];
     }
     return this;
 });

package/lib/compress/index.js

@@ -158,6 +158,7 @@ import {
     return_true,
     regexp_source_fix,
     has_annotation,
+    regexp_is_safe,
 } from "../utils/index.js";
 import { first_in_statement } from "../utils/first_in_statement.js";
 import { equivalent_to } from "../equivalent-to.js";
@@ -2140,6 +2141,7 @@ def_optimize(AST_Call, function(self, compressor) {
                     params.push(value);
                     return arg !== value;
                 })
+                && regexp_is_safe(params[0])
             ) {
                 let [ source, flags ] = params;
                 source = regexp_source_fix(new RegExp(source).source);
@@ -3799,6 +3801,12 @@ def_optimize(AST_Dot, function(self, compressor) {
         const sub = self.flatten_object(self.property, compressor);
         if (sub) return sub.optimize(compressor);
     }
+
+    if (self.expression instanceof AST_PropAccess
+        && parent instanceof AST_PropAccess) {
+        return self;
+    }
+
     let ev = self.evaluate(compressor);
     if (ev !== self) {
         ev = make_node_from_constant(ev, self).optimize(compressor);

package/lib/output.js

@@ -1247,12 +1247,14 @@ function OutputStream(options) {
         output.with_indent(output.next_indent(), function() {
             output.append_comments(self, true);
         });
+        output.add_mapping(self.end);
         output.print("}");
     }
     function print_braced(self, output, allow_directives) {
         if (self.body.length > 0) {
             output.with_block(function() {
                 display_body(self.body, false, output, allow_directives);
+                output.add_mapping(self.end);
             });
         } else print_braced_empty(self, output);
     }

package/lib/utils/index.js

@@ -249,7 +249,15 @@ function regexp_source_fix(source) {
         return (escaped ? "" : "\\") + lineTerminatorEscape[match];
     });
 }
-const all_flags = "gimuy";
+
+// Subset of regexps that is not going to cause regexp based DDOS
+// https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
+const re_safe_regexp = /^[\\/|\0\s\w^$.[\]()]*$/;
+
+/** Check if the regexp is safe for Terser to create without risking a RegExp DOS */
+export const regexp_is_safe = (source) => re_safe_regexp.test(source);
+
+const all_flags = "dgimsuy";
 function sort_regexp_flags(flags) {
     const existing_flags = new Set(flags.split(""));
     let out = "";

package/package.json

@@ -4,7 +4,7 @@
   "homepage": "https://terser.org",
   "author": "Mihai Bazon <mihai.bazon@gmail.com> (http://lisperator.net/)",
   "license": "BSD-2-Clause",
-  "version": "5.14.1",
+  "version": "5.14.2",
   "engines": {
     "node": ">=10"
   },