Description

JLine: ReDoS via HISTORY_IGNORE Configuration Variable

Summary

The JLine3 HISTORY_IGNORE variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than * and : are passed through to the regex engine. A crafted value such as (a+)+b can cause catastrophic backtracking each time a command line is added to history, hanging the reader thread at high CPU.

Details

In reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java, matchPatterns() converts HISTORY_IGNORE into a regex:

for (int i = 0; i < patterns.length(); i++) {
    char ch = patterns.charAt(i);
    if (ch == '\\') {
        ch = patterns.charAt(++i);
        sb.append(ch);
    } else if (ch == ':') {
        sb.append('|');
    } else if (ch == '*') {...
Show more

This logic translates wildcard syntax but does not escape regex metacharacters such as (, ), +, ?, {, }, [, and ]. Those characters therefore reach the Java regex engine unchanged.

Affected source location:

reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java

matchPatterns(String patterns, String line)

PoC

Configure HISTORY_IGNORE to a malicious pattern, for example:

set history-ignore "(a+)+b"

At the JLine prompt, enter a long non-matching line:

aaaaaaaaaaaaaaaaaaaaaaaaaaax

Press Enter.

Expected result:

The prompt does not return.

The reader thread consumes high CPU.

Reproduction environment:

JLine3 on x86_64 Linux

OpenJDK 25.0.2

Impact

This is a denial-of-service vulnerability caused by catastrophic regex backtracking. Applications embedding org.jline:jline-reader are impacted if they allow HISTORY_IGNORE to be configured through user configuration or application settings. The issue is lower severity than the interactive editor findings because the attacker must control configuration, but it can still reliably hang a reader session.

Suggested Fix

The safest fix for the current git head is to stop treating arbitrary HISTORY_IGNORE content as a regex. Instead, escape all characters by default and translate only the intended JLine wildcard syntax (*) and separator syntax (:).

Suggested patch:

diff --git a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java
--- a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java
+++ b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java
@@
         StringBuilder sb = new StringBuilder();
         for (int i = 0; i < patterns.length(); i++) {
             char ch = patterns.charAt(i);
             if (ch == '\\') {...
Show more

Credits

This issue was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.

Mitigation

Aliases

References