fix: Potential ReDoS Vulnerability or Inefficient Regular Expression in Project: Need for Assessment and Mitigation

packages/@vue/cli-plugin-pwa/__tests__/pwaGenerator.spec.js

@@ -1,4 +1,8 @@
 const generateWithPlugin = require('@vue/cli-test-utils/generateWithPlugin')
+const HtmlPwaPlugin = require('../lib/HtmlPwaPlugin')
+const HtmlWebpackPlugin = require('html-webpack-plugin')
+const { performance } = require('perf_hooks')
+global.performance = performance
 
 test('inject import statement for service worker', async () => {
   const { files } = await generateWithPlugin([
@@ -38,3 +42,42 @@ test('inject import statement for service worker (with TS)', async () => {
 
   expect(files['src/main.ts']).toMatch(`import './registerServiceWorker'`)
 })
+
+test('ReDos test', async () => {
+  HtmlWebpackPlugin.getHooks = () => ({
+    beforeEmit: {
+      tapAsync: (id, handler) => {
+        const hugeHtml = '<link rel="icon"'.repeat(100000) + '\u0000'
+        const data = { html: hugeHtml }
+        handler(data, (_err, result) => {})
+      }
+    },
+    alterAssetTagGroups: {
+      tapAsync: () => {}
+    }
+  })
+  const plugin = new HtmlPwaPlugin()
+  const fakeCompiler = {
+    options: { output: { publicPath: '/' } },
+    hooks: {
+      compilation: {
+        tap: (_id, cb) => {
+          const fakeCompilation = {
+            hooks: {
+              processAssets: {
+                tap: (_opts, fn) => {}
+              }
+            }
+          }
+          cb(fakeCompilation)
+        }
+      }
+    }
+  }
+  const startTime = performance.now()
+  plugin.apply(fakeCompiler)
+  const endTime = performance.now()
+  const timeTaken = endTime - startTime
+  console.log(`time taken: ${timeTaken.toFixed(3)} ms`)
+  expect(timeTaken).toBeLessThan(3000)
+}, 3000)

packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js

@@ -64,7 +64,7 @@ module.exports = class HtmlPwaPlugin {
     compiler.hooks.compilation.tap(ID, compilation => {
       HtmlWebpackPlugin.getHooks(compilation).beforeEmit.tapAsync(ID, (data, cb) => {
         // wrap favicon in the base template with IE only comment
-        data.html = data.html.replace(/<link rel="icon"[^>]+>/, '<!--[if IE]>$&<![endif]-->')
+        data.html = data.html.replace(/<link rel="icon"(?!<link rel="icon")[^>]+>/, '<!--[if IE]>$&<![endif]-->')
         cb(null, data)
       })