av/harbor v0.5.18

on GitHub

Security

• Boost discussurl: fixed a regular-expression denial of service (ReDoS). The URL pattern backtracked exponentially on crafted messages, so one chat request could keep Boost busy for seconds to minutes and block other requests, including health checks. URLs are now found with a linear-time scanner (same results for normal links, including Wikipedia-style links with parentheses), and the module scans at most the last 100,000 characters, skips URLs longer than 2,048 characters, and reads at most 10 URLs per request. Only setups that enable the discussurl module were affected. Thanks to Jin Siwen (BUPT ReDoS research team) for the responsible disclosure.
• Boost autocheck and web page reading: removed two slow-pattern cases found while auditing every regex in Boost: symbol detection on messages with many blank lines, and HTML stripping on pages with many unclosed <script>/<style> tags. Both now run in linear time with the same output.

Upgrade: harbor update then harbor build boost (or pull ghcr.io/av/harbor-boost:latest) and restart Boost.

Full Changelog: v0.5.17...v0.5.18