fix:ReDoS fix about pull/5971 and issues/6031

lib/tools/Config.js

@@ -200,7 +200,7 @@ Config._valid = function(key, value, sch){
   // If first type is Array, but current is String, try to split them.
   if(scht.length > 1 && type != scht[0] && type == '[object String]'){
     if(scht[0] == '[object Array]') {
-      value = value.split(/([\w\-]+\="[^"]*")|([\w\-]+\='[^']*')|"([^"]*)"|'([^']*)'|\s/)
+      value = value.split(/(?<![\w\-])([\w\-]+\="[^"]*")|(?<![\w\-])([\w\-]+\='[^']*')|"([^"]*)"|'([^']*)'|\s/)
       // unfortunately, js does not support lookahead RegExp (/(?<!\\)\s+/) now (until next ver).
       //value = value.split(/((?<![\w\-])([\w\-]+\="[^"]*")|(?<![\w\-])([\w\-]+\='[^']*')|"([^"]*)"|'([^']*)'|\s )/)
         .filter(function(v){

test/interface/redos.mocha.js

@@ -0,0 +1,33 @@
+process.chdir(__dirname)
+
+const config = require('../../lib/tools/Config')
+const { performance } = require('perf_hooks')
+let expect;
+before(async () => {
+  const chai = await import('chai')
+  expect = chai.expect
+})
+
+
+describe('ReDos Test', function () {
+  it('should done in 1 s', function () {
+    // 构造 schema，期望值为数组或者字符串
+    const schemaEntry = {
+      type: ['array', 'string']
+    }
+    // 构造测试用的长字符串
+    const value = "a".repeat(100000) + "="
+
+    const startTime = performance.now()
+    const result = config._valid('dummyKey', value, schemaEntry)
+    const endTime = performance.now()
+    const timeTaken = endTime - startTime
+
+    // 输出匹配结果和耗时（调试用）
+    console.log(`Time taken: ${timeTaken.toFixed(3)} ms`)
+
+
+    // 并断言耗时在合理范围内（比如小于1000毫秒）
+    expect(timeTaken).to.be.lessThan(1000)
+  })
+})

test/programmatic/json_validation.mocha.js

@@ -71,5 +71,21 @@ describe('JSON validation tests', function() {
     Object.keys(ret.config).should.containDeep(default_values);
     done();
   });
+
+  it('should split node_args string into array', function () {
+    const cli = '--max-old-space-size=4096 --use-openssl-ca';
 
+    const expected = ['--max-old-space-size=4096', '--use-openssl-ca'];
+
+    const ret = Config.validateJSON({
+      script: 'child.js',
+      name: 'split-test',
+      node_args: cli
+    });
+
+    ret.errors.length.should.eql(0);
+
+    ret.config.node_args.should.eql(expected);
+  });
+
 });

test/unit.sh

@@ -99,6 +99,7 @@ D=test/interface
 runUnitTest $D/bus.spec.mocha.js
 runUnitTest $D/bus.fork.spec.mocha.js
 runUnitTest $D/utility.mocha.js
+runUnitTest $D/redos.mocha.js
 
 echo "============== unit test finished =============="
 cat unit_time