Optimize Regex to Prevent Potential Backtracking Vulnerability GLRenderer.java

[SahebChandok]

Describe the Software Vulnerability
The vulnerability is a Regular Expression Denial of Service (ReDoS), where inefficient regex patterns allow excessive backtracking, leading to significant performance degradation. In the current implementation, the pattern .?(\d+)\.(\d+). uses a lazy quantifier (.*?) and lacks boundaries, making it susceptible to crafted inputs that force the regex engine to evaluate numerous backtracking paths. This can cause high CPU usage, application freezes, or even crashes, effectively creating a denial-of-service scenario.

Type of Vulnerability
Provide a description of the vulnerability - the source code analysis tools
Most of the regular expression engines use backtracking to try all possible execution paths of the regular expression when evaluating an input, in some cases it can cause performance issues, called catastrophic backtracking situations. In the worst case, the complexity of the regular expression is exponential in the size of the input, this means that a small carefully-crafted input (like 20 chars) can trigger catastrophic backtracking and cause a denial of service of the application. Super-linear regex complexity can lead to the same impact too with, in this case, a large carefully-crafted input (thousands chars).

CVE
If a CVE/CWE is specified mentioned it
N/A

Expected outcome
Illustrate how the vulnerability will be patched
Tool Used: SonarQube

The expected outcome of addressing this issue is improved performance and security in regex processing. By optimizing the pattern to eliminate excessive backtracking, the application will handle inputs more efficiently, even for edge cases or potentially malicious strings. This ensures that the regex operates within predictable time limits, preventing high CPU usage, freezing, or crashes. Ultimately, the fix will enhance the application's resilience against Regular Expression Denial of Service (ReDoS) attacks, maintaining its stability and reliability.

Code before refactoring
File Location: jme3-core/src/main/java/com/jme3/renderer/opengl/GLRenderer.java

Code after refactoring

[rajbhensdadiya]

Closing this issue in favor of this PR: #173