util: expose stripVTControlCharacters()

[cjihrig]

This PR exposes the existing stripVTControlCharacters() method with docs and some additional input validation. It also improves the regex used by the function.

[mcollina]

lgtm

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/40124/ 💛

[cjihrig]

Landed in 396b14b and 606bb52.

[thoger]

The regex improvement change (606bb52 / 66d3101) is actually a port of the ansi-regex fix for the CVE-2021-3807 regular expression DoS (ReDoS) issue. References for the fix in ansi-regex:

chalk/ansi-regex#37
chalk/ansi-regex@8d1d7cd

Are there any plans to apply this fix to 14 and 12 as well?

[mcollina]

This regexp was not exposed prior to this PR and not exploitable.

[thoger]

While stripVTControlCharacters() wasn't previously exposed directly (not counting uses with --expose-internals), it is used by getStringWidth(), which is used by other modules - readline, cli_table, source_map. I've not reviewed all these cases, only managed to trigger the regex via readline's rl.write(), just make it write the attack_str as used in the original reproducer: chalk/ansi-regex#37 (comment)

I'm not aware of any real world use case practically exploitable via this issue.

[thoger]

readline reproducer:

const readline = require('readline');
const rl = readline.createInterface({
	input: process.stdin,
	output: process.stdout,
});

for(var i = 1; i <= 5; i++) {
	var time = Date.now();
	var attack_str = "\u001B["+";".repeat(i*10000);
	rl.write(attack_str);
	var time_cost = Date.now() - time;
	console.log("_attack_str.length: " + attack_str.length + ", time: " + time_cost + " ms")
}

rl.close()

[mcollina]

Readline is a developer utility. This is not going to cause a DoS attack.