From 999f635c6817c83c12e8dc9caf54eb5017040da4 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Mon, 29 Jun 2026 10:55:03 +0000 Subject: [PATCH] Fix ReDoS in URL parser Replace unbounded repetitions `*` with length boundaries `{0,2000}` and `{0,100}` in `URL_VALID_PATH` to prevent catastrophic backtracking (ReDoS) when parsing complex text blocks containing overlapping characters. Co-authored-by: dlukt <201112286+dlukt@users.noreply.github.com> --- mastodon/src/main/java/com/twitter/twittertext/Regex.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mastodon/src/main/java/com/twitter/twittertext/Regex.java b/mastodon/src/main/java/com/twitter/twittertext/Regex.java index 61a0fc9d2..bd3f3f526 100644 --- a/mastodon/src/main/java/com/twitter/twittertext/Regex.java +++ b/mastodon/src/main/java/com/twitter/twittertext/Regex.java @@ -222,8 +222,8 @@ protected Regex() { public static final String URL_VALID_PATH = "(?:" + "(?:" + - URL_VALID_GENERAL_PATH_CHARS + "*" + - "(?:" + URL_BALANCED_PARENS + URL_VALID_GENERAL_PATH_CHARS + "*)*" + + URL_VALID_GENERAL_PATH_CHARS + "{0,2000}" + + "(?:" + URL_BALANCED_PARENS + URL_VALID_GENERAL_PATH_CHARS + "{0,2000}){0,100}" + URL_VALID_PATH_ENDING_CHARS + ")|(?:@" + URL_VALID_GENERAL_PATH_CHARS + "+/)" + ")";