[Fix] Re2j for code paths that process user regex

data-prepper-expression/build.gradle

@@ -32,6 +32,7 @@ dependencies {
     implementation 'org.apache.logging.log4j:log4j-core'
     implementation 'org.apache.logging.log4j:log4j-slf4j2-impl'
     implementation 'com.github.seancfoley:ipaddress:5.5.1'
+    implementation 'com.google.re2j:re2j:1.8'
     testImplementation testLibs.spring.test
     testImplementation libs.commons.lang3
     testImplementation 'com.fasterxml.jackson.core:jackson-databind'

data-prepper-expression/src/main/java/org/opensearch/dataprepper/expression/GenericRegexMatchOperator.java

@@ -9,7 +9,7 @@
 import org.opensearch.dataprepper.expression.antlr.DataPrepperExpressionParser;
 
 import java.util.function.BiPredicate;
-import java.util.regex.PatternSyntaxException;
+import com.google.re2j.PatternSyntaxException;
 
 import static com.google.common.base.Preconditions.checkArgument;
 

data-prepper-expression/src/main/java/org/opensearch/dataprepper/expression/OperatorConfiguration.java

@@ -8,6 +8,7 @@
 import org.opensearch.dataprepper.expression.antlr.DataPrepperExpressionParser;
 import org.opensearch.dataprepper.model.event.DataType;
 import org.springframework.context.annotation.Bean;
+import com.google.re2j.Pattern;
 
 import javax.inject.Named;
 import java.util.HashMap;
@@ -20,7 +21,8 @@
 
 @Named
 class OperatorConfiguration {
-    public final BiPredicate<Object, Object> regexEquals = (x, y) -> ((String) x).matches((String) y);
+
+    public final BiPredicate<Object, Object> regexEquals = (x, y) -> Pattern.compile((String) y).matcher((String) x).matches();
     public final BiPredicate<Object, Object> equals = Objects::equals;
     public final BiPredicate<Object, Object> inSet = (x, y) -> ((Set<?>) y).contains(x);
     public final BiPredicate<Object, Object> typeOf = (x, y) -> DataType.isSameType(x, (String)y);

data-prepper-expression/src/test/java/org/opensearch/dataprepper/expression/RegexEqualOperatorTest.java

@@ -6,6 +6,7 @@
 package org.opensearch.dataprepper.expression;
 
 import org.antlr.v4.runtime.ParserRuleContext;
+import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.Mock;
@@ -18,6 +19,8 @@
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.Mockito.when;
 
+import java.time.Duration;
+
 @ExtendWith(MockitoExtension.class)
 class RegexEqualOperatorTest {
     final GenericRegexMatchOperator objectUnderTest = new OperatorConfiguration().regexEqualOperator();
@@ -50,6 +53,18 @@ void testEvalValidArgs() {
         assertThat(objectUnderTest.evaluate("a", "b*"), is(false));
     }
 
+    @Test
+    void testEvalAdversarialArgs() {
+        Boolean result1 = Assertions.assertTimeoutPreemptively(Duration.ofMillis(1000), () -> {
+            return objectUnderTest.evaluate("a".repeat(256*1024) + "X", "(a+)+");
+        });
+        assertThat(result1, is(false));
+        Boolean result2 = Assertions.assertTimeoutPreemptively(Duration.ofMillis(1000), () -> {
+            return objectUnderTest.evaluate("ab".repeat(128*1024) + "X", "(a|ab)*");
+        });
+        assertThat(result2, is(false));
+    }
+
     @Test
     void testEvalInValidArgLength() {
         assertThrows(IllegalArgumentException.class, () -> objectUnderTest.evaluate("a"));

data-prepper-expression/src/test/java/org/opensearch/dataprepper/expression/RegexNotEqualOperatorTest.java

@@ -6,6 +6,7 @@
 package org.opensearch.dataprepper.expression;
 
 import org.antlr.v4.runtime.ParserRuleContext;
+import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.Mock;
@@ -18,6 +19,8 @@
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.Mockito.when;
 
+import java.time.Duration;
+
 @ExtendWith(MockitoExtension.class)
 class RegexNotEqualOperatorTest {
     final GenericRegexMatchOperator objectUnderTest = new OperatorConfiguration().regexNotEqualOperator();
@@ -50,6 +53,18 @@ void testEvalValidArgs() {
         assertThat(objectUnderTest.evaluate("a", "b*"), is(true));
     }
 
+    @Test
+    void testEvalAdversarialArgs() {
+        Boolean result1 = Assertions.assertTimeoutPreemptively(Duration.ofMillis(1000), () -> {
+            return objectUnderTest.evaluate("a".repeat(256*1024) + "X", "(a+)+");
+        });
+        assertThat(result1, is(true));
+        Boolean result2 = Assertions.assertTimeoutPreemptively(Duration.ofMillis(1000), () -> {
+            return objectUnderTest.evaluate("ab".repeat(128*1024) + "X", "(a|ab)*");
+        });
+        assertThat(result2, is(true));
+    }
+
     @Test
     void testEvalInValidArgLength() {
         assertThrows(IllegalArgumentException.class, () -> objectUnderTest.evaluate("a"));

data-prepper-plugins/key-value-processor/build.gradle

@@ -22,4 +22,5 @@ dependencies {
     implementation project(':data-prepper-api')
     implementation project(':data-prepper-plugins:common')
     implementation 'com.fasterxml.jackson.core:jackson-databind'
+    implementation 'com.google.re2j:re2j:1.8'
 }

data-prepper-plugins/key-value-processor/src/main/java/org/opensearch/dataprepper/plugins/processor/keyvalue/KeyValueProcessor.java

@@ -32,9 +32,9 @@
 import java.util.LinkedHashMap;
 import java.util.Objects;
 import java.util.Set;
-import java.util.regex.Pattern;
-import java.util.regex.PatternSyntaxException;
-import java.util.regex.Matcher;
+import com.google.re2j.Pattern;
+import com.google.re2j.PatternSyntaxException;
+import com.google.re2j.Matcher;
 import java.util.Stack;
 import java.util.ArrayList;
 
@@ -85,7 +85,7 @@ public KeyValueProcessor(final PluginMetrics pluginMetrics,
                 && !keyValueProcessorConfig.getFieldSplitCharacters().isEmpty()) {
                 throw new IllegalArgumentException("field_delimiter_regex and field_split_characters cannot both be defined.");
             } else if (!validateRegex(keyValueProcessorConfig.getFieldDelimiterRegex())) {
-                throw new PatternSyntaxException("field_delimiter_regex is not a valid regex string", keyValueProcessorConfig.getFieldDelimiterRegex(), -1);
+                throw new PatternSyntaxException("field_delimiter_regex is not a valid regex string", keyValueProcessorConfig.getFieldDelimiterRegex());
             }
 
             fieldDelimiterPattern = Pattern.compile(keyValueProcessorConfig.getFieldDelimiterRegex());
@@ -121,7 +121,7 @@ public KeyValueProcessor(final PluginMetrics pluginMetrics,
                 && !keyValueProcessorConfig.getValueSplitCharacters().isEmpty()) {
                 throw new IllegalArgumentException("key_value_delimiter_regex and value_split_characters cannot both be defined.");
             } else if (!validateRegex(keyValueProcessorConfig.getKeyValueDelimiterRegex())) {
-                throw new PatternSyntaxException("key_value_delimiter_regex is not a valid regex string", keyValueProcessorConfig.getKeyValueDelimiterRegex(), -1);
+                throw new PatternSyntaxException("key_value_delimiter_regex is not a valid regex string", keyValueProcessorConfig.getKeyValueDelimiterRegex());
             }
 
             keyValueDelimiterPattern = Pattern.compile(keyValueProcessorConfig.getKeyValueDelimiterRegex());
@@ -152,11 +152,11 @@ public KeyValueProcessor(final PluginMetrics pluginMetrics,
         }
 
         if (!validateRegex(keyValueProcessorConfig.getDeleteKeyRegex())) {
-            throw new PatternSyntaxException("delete_key_regex is not a valid regex string", keyValueProcessorConfig.getDeleteKeyRegex(), -1);
+            throw new PatternSyntaxException("delete_key_regex is not a valid regex string", keyValueProcessorConfig.getDeleteKeyRegex());
         }
 
         if (!validateRegex(keyValueProcessorConfig.getDeleteValueRegex())) {
-            throw new PatternSyntaxException("delete_value_regex is not a valid regex string", keyValueProcessorConfig.getDeleteValueRegex(), -1);
+            throw new PatternSyntaxException("delete_value_regex is not a valid regex string", keyValueProcessorConfig.getDeleteValueRegex());
         }
 
         includeKeysSet.addAll(keyValueProcessorConfig.getIncludeKeys());

data-prepper-plugins/key-value-processor/src/test/java/org/opensearch/dataprepper/plugins/processor/keyvalue/KeyValueProcessorTests.java

@@ -32,7 +32,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.UUID;
-import java.util.regex.PatternSyntaxException;
+import com.google.re2j.PatternSyntaxException;
 import java.util.stream.Stream;
 
 import static org.hamcrest.CoreMatchers.equalTo;
@@ -414,7 +414,7 @@ void testBadKeyValueDelimiterRegexKeyValueProcessor() {
         when(mockConfig.getValueSplitCharacters()).thenReturn(null);
 
         PatternSyntaxException e = assertThrows(PatternSyntaxException.class, this::createObjectUnderTest);
-        assertThat(e.getMessage(), CoreMatchers.startsWith("key_value_delimiter"));
+        assertThat(e.getMessage(), CoreMatchers.startsWith("error parsing regexp: key_value_delimiter"));
     }
 
     @Test
@@ -423,21 +423,21 @@ void testBadFieldDelimiterRegexKeyValueProcessor() {
         when(mockConfig.getFieldSplitCharacters()).thenReturn(null);
 
         PatternSyntaxException e = assertThrows(PatternSyntaxException.class, this::createObjectUnderTest);
-        assertThat(e.getMessage(), CoreMatchers.startsWith("field_delimiter"));
+        assertThat(e.getMessage(), CoreMatchers.startsWith("error parsing regexp: field_delimiter"));
     }
 
     @Test
     void testBadDeleteKeyRegexKeyValueProcessor() {
         when(mockConfig.getDeleteKeyRegex()).thenReturn("[");
         PatternSyntaxException e = assertThrows(PatternSyntaxException.class, this::createObjectUnderTest);
-        assertThat(e.getMessage(), CoreMatchers.startsWith("delete_key_regex"));
+        assertThat(e.getMessage(), CoreMatchers.startsWith("error parsing regexp: delete_key_regex"));
     }
 
     @Test
     void testBadDeleteValueRegexKeyValueProcessor() {
         when(mockConfig.getDeleteValueRegex()).thenReturn("[");
         PatternSyntaxException e = assertThrows(PatternSyntaxException.class, this::createObjectUnderTest);
-        assertThat(e.getMessage(), CoreMatchers.startsWith("delete_value_regex"));
+        assertThat(e.getMessage(), CoreMatchers.startsWith("error parsing regexp: delete_value_regex"));
     }
 
     @Test

data-prepper-plugins/mutate-event-processors/build.gradle

@@ -22,6 +22,7 @@ dependencies {
     implementation project(':data-prepper-api')
     implementation project(':data-prepper-plugins:common')
     implementation 'com.fasterxml.jackson.core:jackson-databind'
+    implementation 'com.google.re2j:re2j:1.8'
     testImplementation project(':data-prepper-test:test-event')
     testImplementation testLibs.slf4j.simple
     testImplementation testLibs.spring.test

data-prepper-plugins/mutate-event-processors/src/main/java/org/opensearch/dataprepper/plugins/processor/mutateevent/DeleteEntryProcessor.java

@@ -27,7 +27,7 @@
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 import java.util.stream.Collectors;
 
 @DataPrepperPlugin(name = "delete_entries", pluginType = Processor.class, pluginConfigurationType = DeleteEntryProcessorConfig.class)

data-prepper-plugins/mutate-event-processors/src/main/java/org/opensearch/dataprepper/plugins/processor/mutateevent/DeleteEntryProcessorConfig.java

@@ -26,8 +26,8 @@
 import java.util.Collections;
 import java.util.List;
 import java.util.Set;
-import java.util.regex.Pattern;
-import java.util.regex.PatternSyntaxException;
+import com.google.re2j.Pattern;
+import com.google.re2j.PatternSyntaxException;
 import java.util.stream.Collectors;
 
 @ConditionalRequired(value = {

data-prepper-plugins/mutate-event-processors/src/main/java/org/opensearch/dataprepper/plugins/processor/mutateevent/RenameKeyProcessor.java

@@ -24,7 +24,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 
 @DataPrepperPlugin(name = "rename_keys", pluginType = Processor.class, pluginConfigurationType = RenameKeyProcessorConfig.class)
 public class RenameKeyProcessor extends AbstractProcessor<Record<Event>, Record<Event>> {

data-prepper-plugins/mutate-event-processors/src/main/java/org/opensearch/dataprepper/plugins/processor/mutateevent/RenameKeyProcessorConfig.java

@@ -24,7 +24,7 @@
 import org.opensearch.dataprepper.model.event.EventKeyFactory;
 
 import java.util.List;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 
 @JsonPropertyOrder
 @JsonClassDescription("The <code>rename_keys</code> processor renames keys in an event.")

data-prepper-plugins/mutate-event-processors/src/main/java/org/opensearch/dataprepper/plugins/processor/mutateevent/SelectEntriesProcessor.java

@@ -21,7 +21,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 
 @DataPrepperPlugin(name = "select_entries", pluginType = Processor.class, pluginConfigurationType = SelectEntriesProcessorConfig.class)
 public class SelectEntriesProcessor extends AbstractProcessor<Record<Event>, Record<Event>> {

data-prepper-plugins/mutate-event-processors/src/main/java/org/opensearch/dataprepper/plugins/processor/mutateevent/SelectEntriesProcessorConfig.java

@@ -15,8 +15,8 @@
 import org.opensearch.dataprepper.model.annotations.ExampleValues.Example;
 
 import java.util.List;
-import java.util.regex.Pattern;
-import java.util.regex.PatternSyntaxException;
+import com.google.re2j.Pattern;
+import com.google.re2j.PatternSyntaxException;
 import java.util.stream.Collectors;
 
 @JsonPropertyOrder

data-prepper-plugins/mutate-event-processors/src/test/java/org/opensearch/dataprepper/plugins/processor/mutateevent/SelectEntriesProcessorTests.java

@@ -22,7 +22,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.UUID;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.equalTo;

data-prepper-plugins/mutate-string-processors/build.gradle

@@ -21,6 +21,7 @@ jacocoTestCoverageVerification {
 dependencies {
     implementation project(':data-prepper-api')
     implementation project(':data-prepper-plugins:common')
+    implementation 'com.google.re2j:re2j:1.8'
     implementation 'com.fasterxml.jackson.core:jackson-databind'
     testImplementation project(':data-prepper-test:test-event')
 }

data-prepper-plugins/mutate-string-processors/src/main/java/org/opensearch/dataprepper/plugins/processor/mutatestring/SplitStringProcessor.java

@@ -17,7 +17,7 @@
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 
 @DataPrepperPlugin(name = "split_string", pluginType = Processor.class, pluginConfigurationType = SplitStringProcessorConfig.class)
 public class SplitStringProcessor extends AbstractStringProcessor<SplitStringProcessorConfig.Entry> {

data-prepper-plugins/mutate-string-processors/src/main/java/org/opensearch/dataprepper/plugins/processor/mutatestring/SubstituteStringProcessor.java

@@ -17,8 +17,8 @@
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
+import com.google.re2j.Matcher;
+import com.google.re2j.Pattern;
 
 /**
  * This processor takes in a key and changes its value by searching for a pattern and replacing the matches with a string.

data-prepper-plugins/mutate-string-processors/src/test/java/org/opensearch/dataprepper/plugins/processor/mutatestring/SubstituteStringProcessorTests.java

@@ -28,7 +28,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.UUID;
-import java.util.regex.PatternSyntaxException;
+import com.google.re2j.PatternSyntaxException;
 
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.is;

data-prepper-plugins/obfuscate-processor/build.gradle

@@ -3,6 +3,7 @@ dependencies {
     implementation project(':data-prepper-plugins:common')
     implementation 'com.fasterxml.jackson.core:jackson-core'
     implementation 'com.fasterxml.jackson.core:jackson-databind'
+    implementation 'com.google.re2j:re2j:1.8'
     testImplementation project(':data-prepper-test:test-common')
     testImplementation project(':data-prepper-test:test-event') 
 }

data-prepper-plugins/obfuscate-processor/src/main/java/org/opensearch/dataprepper/plugins/processor/obfuscation/ObfuscationProcessor.java

@@ -28,8 +28,8 @@
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
+import com.google.re2j.Matcher;
+import com.google.re2j.Pattern;
 
 @DataPrepperPlugin(name = "obfuscate", pluginType = Processor.class, pluginConfigurationType = ObfuscationProcessorConfig.class)
 public class ObfuscationProcessor extends AbstractProcessor<Record<Event>, Record<Event>> {

data-prepper-plugins/obfuscate-processor/src/main/java/org/opensearch/dataprepper/plugins/processor/obfuscation/action/MaskAction.java

@@ -11,7 +11,7 @@
 import org.opensearch.dataprepper.model.record.Record;
 
 import java.util.List;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 
 @DataPrepperPlugin(name = "mask", pluginType = ObfuscationAction.class, pluginConfigurationType = MaskActionConfig.class)
 public class MaskAction implements ObfuscationAction {

data-prepper-plugins/obfuscate-processor/src/main/java/org/opensearch/dataprepper/plugins/processor/obfuscation/action/ObfuscationAction.java

@@ -6,7 +6,7 @@
 package org.opensearch.dataprepper.plugins.processor.obfuscation.action;
 
 import java.util.List;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 
 import org.opensearch.dataprepper.model.event.Event;
 import org.opensearch.dataprepper.model.record.Record;

data-prepper-plugins/obfuscate-processor/src/main/java/org/opensearch/dataprepper/plugins/processor/obfuscation/action/OneWayHashAction.java

@@ -12,8 +12,8 @@
 import java.util.Arrays;
 import java.util.Base64;
 import java.util.List;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
+import com.google.re2j.Matcher;
+import com.google.re2j.Pattern;
 
 import org.opensearch.dataprepper.model.annotations.DataPrepperPlugin;
 import org.opensearch.dataprepper.model.annotations.DataPrepperPluginConstructor;

data-prepper-plugins/obfuscate-processor/src/test/java/org/opensearch/dataprepper/plugins/processor/obfuscation/action/MaskActionTest.java

@@ -11,7 +11,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;

data-prepper-plugins/obfuscate-processor/src/test/java/org/opensearch/dataprepper/plugins/processor/obfuscation/action/OneWayHashActionTest.java

@@ -25,7 +25,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 
 import org.opensearch.dataprepper.event.TestEventKeyFactory;
 import org.opensearch.dataprepper.model.event.EventKeyFactory;

data-prepper-plugins/split-event-processor/build.gradle

@@ -19,4 +19,5 @@ dependencies {
     implementation project(':data-prepper-api')
     implementation project(':data-prepper-plugins:common')
     implementation 'com.fasterxml.jackson.core:jackson-databind'
+    implementation 'com.google.re2j:re2j:1.8'
 }

data-prepper-plugins/split-event-processor/src/main/java/org/opensearch/dataprepper/plugins/processor/splitevent/SplitEventProcessor.java

@@ -23,7 +23,7 @@
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.function.Function;
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;
 
 
 @DataPrepperPlugin(name = "split_event", pluginType = Processor.class, pluginConfigurationType = SplitEventProcessorConfig.class)