Possible ReDoS

[mothershipper]

User input is turned into a regex and ran against each command name. This can turn into a regex denial-of-service situation if the user can craft a regex with catastrophic backtracking against the current set of commands registered. I haven't found a practical example that starves out hubot in our deployment, but have verified it's possible.

For instance, if you registered a command named "xxxxxxxxxxxxxxxxxxxxxxxxxxg", then sent "(x*)+p", it would trigger the backtracking behavior and freeze up hubot.

hubot-help/src/help.js

Line 66 in bb3abbc

cmds = cmds.filter(cmd => cmd.match(new RegExp(filter, 'i')))

Wondering if something like this should be run against the user input, or some validation done (allow only a single wildcard, etc.).

[joeyguerra]

What if the code used contains instead of a Regex?