T3MP3ST v1 — hardened launch (AGPL, verify-claims 24/24, leak-scrubbed)

bench/cve-zero/results/hunt-GHSA-m6xr-fvfg-5g64.json

@@ -1 +1 @@
-{"id": "GHSA-m6xr-fvfg-5g64", "cve": "CVE-2026-46378", "repo": "TomWright/dasel", "cwes": ["CWE-835"], "vuln_files": ["selector/lexer/tokenize.go", "selector/lexer/tokenize_test.go"], "duration_sec": 77.8, "error": null, "strict": false, "lenient": true, "findings_scored": [{"fileMatch": true, "lineProx": false, "cweMatch": false, "hit": false, "title": "Panic (index out of range) when selector ends with whitespace", "file": "selector/lexer/tokenize.go", "line": 60, "cwe": "CWE-125"}, {"fileMatch": true, "lineProx": true, "cweMatch": true, "hit": true, "title": "Infinite loop on unterminated regex literal r/...", "file": "selector/lexer/tokenize.go", "line": 280, "cwe": "CWE-835"}], "n_findings": 2, "findings": [{"title": "Panic (index out of range) when selector ends with whitespace", "file": "selector/lexer/tokenize.go", "line": 60, "cwe": "CWE-125", "vuln_class": "dos", "severity": "high", "description": "In parseCurRune(), after the leading whitespace-skip loop (line 55) advances p.i, the code unconditionally dereferences p.src[p.i] at line 60 (the '//' comment check) and again at line 74 (the main switch) without re-checking p.i < p.srcLen. Next() guards only the entry condition p.i >= len(p.src), so any selector that contains trailing whitespace (or whose remaining suffix is only whitespace after a comment) will cause p.i to reach p.srcLen inside parseCurRune, and the next p.src[p.i] access panics with 'runtime error: index out of range'. Anywhere dasel exposes selector parsing to untrusted input (CLI args, library users, or any service embedding dasel's selector lexer), a one-byte attacker-controlled string such as a single space crashes the process. Tokenize() is the documented entrypoint, so reachability is trivial.", "poc": "lexer.NewTokenizer(\" \").Tokenize()  // panics: runtime error: index out of range [1] with length 1.  Also reproducible with any selector ending in whitespace, e.g. \"foo \" or \"a.b  \".", "confidence": 0.95}, {"title": "Infinite loop on unterminated regex literal r/...", "file": "selector/lexer/tokenize.go", "line": 280, "cwe": "CWE-835", "vuln_class": "dos", "severity": "high", "description": "matchRegexPattern (line 274) recognises an 'r/' prefix and then scans for the closing '/': `for !p.peekRuneEqual(pos, '/') { pos++ }`. peekRuneEqual returns false whenever pos >= p.srcLen, so once pos walks past the end of the input without finding a '/', the condition stays true forever and pos is incremented without bound. There is no srcLen guard inside the loop and no error path for an unterminated regex. Any selector containing `r/` without a matching closing slash causes Tokenize() to hang, consuming a CPU core indefinitely (and eventually causing an integer overflow / huge allocation if it ever exited at p.src[start+2:pos-1]).", "poc": "lexer.NewTokenizer(\"r/abc\").Tokenize()  // hangs forever inside matchRegexPattern's scan loop.", "confidence": 0.95}], "transcript": ""}
+{"id": "GHSA-m6xr-fvfg-5g64", "cve": "CVE-2026-46378", "repo": "TomWright/dasel", "cwes": ["CWE-835"], "vuln_files": ["selector/lexer/tokenize.go", "selector/lexer/tokenize_test.go"], "duration_sec": 195.7, "error": null, "strict": true, "lenient": true, "findings_scored": [{"fileMatch": true, "lineProx": true, "cweMatch": true, "hit": true, "title": "Unbounded loop when lexing an unterminated regex pattern (r/...)", "file": "selector/lexer/tokenize.go", "line": 280, "cwe": "CWE-835"}, {"fileMatch": true, "lineProx": false, "cweMatch": false, "hit": false, "title": "Index-out-of-range panic on all-whitespace / trailing-whitespace selector", "file": "selector/lexer/tokenize.go", "line": 59, "cwe": "CWE-125"}], "n_findings": 2, "findings": [{"title": "Unbounded loop when lexing an unterminated regex pattern (r/...)", "file": "selector/lexer/tokenize.go", "line": 280, "cwe": "CWE-835", "vuln_class": "dos", "description": "matchRegexPattern is invoked whenever a token begins with the two characters 'r/'. After consuming 'r/' (pos += 2), the loop `for !p.peekRuneEqual(pos, '/') { pos++ }` scans for the closing slash with NO upper-bound check on pos. peekRuneEqual returns false for any pos >= srcLen (it never signals end-of-input), so when the input contains 'r/' but no closing '/', the negated condition (!false) stays true forever and pos is incremented without limit. The lexer hangs, pinning a CPU core indefinitely. Because dasel tokenizes attacker-supplied selector strings, any caller that lexes a user-provided selector containing an unterminated regex literal is subject to an unrecoverable denial of service (a hung goroutine, unlike a panic, cannot be caught with recover). Note the subsequent slice p.src[start+2:pos-1] would also panic once pos exceeds len(src), but the loop never exits to reach it.", "poc": "Tokenize a selector that contains an unterminated regex pattern, e.g. lexer.NewTokenizer(\"r/abc\").Tokenize() or any selector like \".foo == r/unterminated\". The Tokenize() call never returns and consumes 100% CPU.", "confidence": 0.9}, {"title": "Index-out-of-range panic on all-whitespace / trailing-whitespace selector", "file": "selector/lexer/tokenize.go", "line": 59, "cwe": "CWE-125", "vuln_class": "dos", "description": "parseCurRune first advances past whitespace with `for p.i < p.srcLen && unicode.IsSpace(...) { p.i++ }`, after which p.i can legitimately equal p.srcLen. The very next statement, the comment check `p.src[p.i] == '/'`, dereferences p.src[p.i] with no `p.i < p.srcLen` guard. Next() only guards the initial call (p.i >= len(p.src)), so a selector consisting of (or ending in) whitespace drives p.i to srcLen and triggers an out-of-range index panic. Combined with the rune-count/byte-index mismatch (srcLen = len([]rune(src)) but indexing uses byte offsets p.src[p.i]), multi-byte UTF-8 selectors can also index past valid positions. Any service tokenizing an untrusted selector can be crashed.", "poc": "lexer.NewTokenizer(\" \").Tokenize()  // single space -> panic: runtime error: index out of range [1] with length 1. Also triggered by any selector ending in whitespace, e.g. \".foo \".", "confidence": 0.75}], "transcript": ""}