fix(utils): ReDoS (cubic backtracking) in _strip_json_code_fence - #7082
Open
thinhnallf wants to merge 1 commit into
Open
fix(utils): ReDoS (cubic backtracking) in _strip_json_code_fence#7082thinhnallf wants to merge 1 commit into
thinhnallf wants to merge 1 commit into
Conversation
…de_fence The fence-stripping regex backtracks in O(n^3) on an unclosed code fence whose body is whitespace. It runs on model output before schema validation (llm_agent, agent_tool, workflow wrapper), so a large model response can hang the event loop for all concurrent requests. Replace with linear string ops.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
_strip_json_code_fenceinsrc/google/adk/utils/_schema_utils.pyuses a regexre.fullmatch(r"```\w*\s*(.*?)\s*```", stripped, re.DOTALL)that exhibitscatastrophic backtracking (ReDoS), cubic O(n^3). It runs on
model-generated text before schema validation whenever
output_schemais set:agents/llm_agent.py(validate_schema(self.output_schema, result))tools/agent_tool.py(validate_schema(output_schema, merged_text))workflow/_llm_agent_wrapper.py(validate_schema(agent.output_schema, text))No length cap precedes the regex (only an empty-string check).
Root cause
The overlapping whitespace quantifiers — leading
\s*, the DOTALL-lazy(.*?)(which also matches whitespace), and trailing
\s*— create an ambiguouspartition of a whitespace run when the closing ``` fence is absent.
re.fullmatchbacktracks over O(n^3) partitions before failing.Impact
Python
reis C-level and holds the GIL for the whole match, so one craftedoutput hangs the entire asyncio event loop (all concurrent requests). Realistic
trigger: indirect prompt injection makes the model emit an unclosed ```json
fence with a whitespace body + one non-whitespace char.
Reproduction (measured)
~7.5x per doubling ⇒ O(n^3). ~8 KB of output hangs for minutes.
Fix
Replace the regex with linear string operations plus one anchored,
non-backtracking regex for the optional language tag. Behaviour is identical on
all well-formed inputs; the attack input drops from ~35 s (n=4000) to
sub-millisecond.