Fix ReDoS vulnerability in FirebaseError template replacement

.changeset/breezy-symbols-walk.md

@@ -0,0 +1,5 @@
+---
+"@firebase/util": patch
+---
+
+Fix ReDoS vulnerability in FirebaseError template replacement

.github/workflows/test-changed-auth.yml

@@ -91,6 +91,8 @@ jobs:
         with:
           node-version: 22.12.0
       - name: Test setup and yarn install
+        env:
+          CHROMEDRIVER_SKIP_DOWNLOAD: true
         run: |
           cp config/ci.config.json config/project.json
           yarn
@@ -116,6 +118,8 @@ jobs:
         with:
           node-version: 22.12.0
       - name: Test setup and yarn install
+        env:
+          CHROMEDRIVER_SKIP_DOWNLOAD: true
         run: |
           cp config/ci.config.json config/project.json
           yarn

.github/workflows/test-changed.yml

@@ -69,6 +69,8 @@ jobs:
       - name: install Firefox stable
         run: npx @puppeteer/browsers install firefox@stable
       - name: Test setup and yarn install
+        env:
+          CHROMEDRIVER_SKIP_DOWNLOAD: true
         run: |
           cp config/ci.config.json config/project.json
           yarn
@@ -95,6 +97,8 @@ jobs:
         with:
           node-version: 22.12.0
       - name: Test setup and yarn install
+        env:
+          CHROMEDRIVER_SKIP_DOWNLOAD: true
         run: |
           cp config/ci.config.json config/project.json
           yarn

packages/auth/firebase.json

@@ -0,0 +1,13 @@
+{
+  "emulators": {
+    "auth": {
+      "port": 9098
+    },
+    "hub": {
+      "port": 4402
+    },
+    "logging": {
+      "port": 4502
+    }
+  }
+}

packages/auth/package.json

@@ -136,7 +136,7 @@
     "@rollup/plugin-strip": "3.0.4",
     "@types/express": "4.17.21",
     "@types/selenium-webdriver": "4.35.6",
-    "chromedriver": "119.0.1",
+    "chromedriver": "^150.0.0",
     "cookie-store": "4.0.0-next.4",
     "rollup": "2.79.2",
     "rollup-plugin-sourcemaps": "0.6.3",

packages/auth/test/integration/webdriver/compat/firebaseui.test.ts

@@ -46,7 +46,7 @@ browserDescribe('WebDriver integration with FirebaseUI', driver => {
     const page = await startUi();
     await page.clickGuestSignIn();
     await waitForLoggedInPage();
-    const snap = (await driver.getUserSnapshot()) as User;
+    const snap = (await driver.getUserSnapshot()) as unknown as User;
     expect(snap.isAnonymous).to.be.true;
     expect(snap.uid).to.be.a('string');
   });
@@ -70,7 +70,7 @@ browserDescribe('WebDriver integration with FirebaseUI', driver => {
     await driver.call(UiFunction.LOAD);
     await startUi();
     await waitForLoggedInPage();
-    const snap = (await driver.getUserSnapshot()) as User;
+    const snap = (await driver.getUserSnapshot()) as unknown as User;
     expect(snap.isAnonymous).to.be.false;
     expect(snap.displayName).to.eq('Bob Test');
     expect(snap.email).to.eq('bob@bob.test');
@@ -97,7 +97,7 @@ browserDescribe('WebDriver integration with FirebaseUI', driver => {
     // Now we're back. Firebase UI should handle the redirect result handoff
     await driver.selectMainWindow();
     await waitForLoggedInPage();
-    const snap = (await driver.getUserSnapshot()) as User;
+    const snap = (await driver.getUserSnapshot()) as unknown as User;
     expect(snap.isAnonymous).to.be.false;
     expect(snap.displayName).to.eq('Bob Test');
     expect(snap.email).to.eq('bob@bob.test');
@@ -135,7 +135,7 @@ browserDescribe('WebDriver integration with FirebaseUI', driver => {
     await page.clickSubmit();
 
     await waitForLoggedInPage();
-    const snap = (await driver.getUserSnapshot()) as User;
+    const snap = (await driver.getUserSnapshot()) as unknown as User;
     expect(snap.isAnonymous).to.be.false;
     expect(snap.phoneNumber).to.eq(`+1${phoneNumber}`);
     expect(snap.uid).to.be.a('string');
@@ -152,7 +152,7 @@ browserDescribe('WebDriver integration with FirebaseUI', driver => {
     await page.clickSubmit();
 
     await waitForLoggedInPage();
-    const snap = (await driver.getUserSnapshot()) as User;
+    const snap = (await driver.getUserSnapshot()) as unknown as User;
     expect(snap.isAnonymous).to.be.false;
     expect(snap.displayName).to.eq('Foo Test');
     expect(snap.email).to.eq('foo@foo.test');

packages/util/src/errors.ts

@@ -127,10 +127,30 @@ export class ErrorFactory<
 }
 
 function replaceTemplate(template: string, data: ErrorData): string {
-  return template.replace(PATTERN, (_, key) => {
-    const value = data[key];
-    return value != null ? String(value) : `<${key}?>`;
-  });
+  try {
+    let ptr = 0;
+    let result = '';
+    while (ptr < template.length) {
+      const start = template.indexOf('{$', ptr);
+      if (start === -1) {
+        result += template.substring(ptr);
+        break;
+      }
+      const end = template.indexOf('}', start + 2);
+      if (end === -1) {
+        result += template.substring(ptr);
+        break;
+      }
+      const key = template.substring(start + 2, end);
+      const value = data[key];
+      result +=
+        template.substring(ptr, start) +
+        (value != null ? String(value) : `<${key}?>`);
+      ptr = end + 1;
+    }
+    return result;
+  } catch (e) {
+    // Should never happen, but fallback just in case
+    return template;
+  }
 }
-
-const PATTERN = /\{\$([^}]+)}/g;

packages/util/test/errors.test.ts

@@ -80,6 +80,19 @@ describe('FirebaseError', () => {
     );
   });
 
+  it('falls back to template if template replacement throws', () => {
+    const e = ERROR_FACTORY.create('file-not-found', {
+      get file() {
+        throw new Error('accessing file throws');
+      }
+    } as any);
+    assert.equal((e as FirebaseError)?.code, 'fake/file-not-found');
+    assert.equal(
+      e.message,
+      "Fake: Could not find file: '{$file}' (fake/file-not-found)."
+    );
+  });
+
   it('has stack', () => {
     const e = ERROR_FACTORY.create('generic-error');