You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@flink.apache.org by "Taranpreet Kaur (Jira)" <ji...@apache.org> on 2026/07/20 04:47:00 UTC

[jira] [Created] (FLINK-40189) Found Security Vunerability in IndexGeneratorFactory.java

Taranpreet Kaur created FLINK-40189:
---------------------------------------

             Summary: Found Security Vunerability in IndexGeneratorFactory.java
                 Key: FLINK-40189
                 URL: https://issues.apache.org/jira/browse/FLINK-40189
             Project: Flink
          Issue Type: Bug
          Components: Connectors / Opensearch
            Reporter: Taranpreet Kaur


  Problem

  Two regex patterns are vulnerable to catastrophic backtracking (polynomial/exponential runtime):

  Line 207 — dynamicIndexTimeExtractPattern:

  Pattern.compile(".*\\\{.+\\|.*\\}.*");

  Line 209 — dynamicIndexSystemTimeExtractPattern:

  Pattern.compile(".*\\\{\\s*(now\\(\\s*\\)|NOW\\(\\s*\\)|current_timestamp|CURRENT_TIMESTAMP)\\s*\\|.*\\}.*");

  Why These Are Vulnerable

  Both patterns use multiple overlapping greedy quantifiers (.*, .+, .*) that can match the same characters. When the regex
  engine fails to find a match, it backtracks through all possible combinations of how to split the input between these
  quantifiers.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)