fix(chromium): better default deny list regexp

pkg/gotenberg/flags.go

@@ -1,9 +1,9 @@
 package gotenberg
 
 import (
-	"regexp"
 	"time"
 
+	"github.com/dlclark/regexp2"
 	"github.com/labstack/gommon/bytes"
 	flag "github.com/spf13/pflag"
 )
@@ -199,19 +199,19 @@ func (f *ParsedFlags) MustDeprecatedHumanReadableBytesString(deprecated string,
 
 // MustRegexp returns the regular expression of a flag given by name.
 // It panics if an error occurs.
-func (f *ParsedFlags) MustRegexp(name string) *regexp.Regexp {
+func (f *ParsedFlags) MustRegexp(name string) *regexp2.Regexp {
 	val, err := f.GetString(name)
 	if err != nil {
 		panic(err)
 	}
 
-	return regexp.MustCompile(val)
+	return regexp2.MustCompile(val, 0)
 }
 
 // MustDeprecatedRegexp returns the regular expression of a deprecated flag if
 // it was explicitly set or the regular expression of the new flag.
 // It panics if an error occurs.
-func (f *ParsedFlags) MustDeprecatedRegexp(deprecated string, newName string) *regexp.Regexp {
+func (f *ParsedFlags) MustDeprecatedRegexp(deprecated string, newName string) *regexp2.Regexp {
 	if f.Changed(deprecated) {
 		return f.MustRegexp(deprecated)
 	}

pkg/gotenberg/regexp.go

@@ -0,0 +1,53 @@
+package gotenberg
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/dlclark/regexp2"
+)
+
+// ErrFiltered happens if a value is filtered by the [FilterDeadline] function.
+var ErrFiltered = errors.New("value filtered")
+
+// FilterDeadline checks if given value is allowed and not denied according to
+// regex patterns. It returns a [context.DeadlineExceeded] if it takes too long
+// to process.
+func FilterDeadline(allowed, denied *regexp2.Regexp, s string, deadline time.Time) error {
+	// FIXME: not ideal to compile everytime, but is there another way to create a clone?
+	if allowed.String() != "" {
+		allow := regexp2.MustCompile(allowed.String(), 0)
+		allow.MatchTimeout = time.Until(deadline)
+
+		ok, err := allow.MatchString(s)
+		if err != nil {
+			if time.Now().After(deadline) {
+				return context.DeadlineExceeded
+			}
+			return fmt.Errorf("'%s' cannot handle '%s': %w", allow.String(), s, err)
+		}
+		if !ok {
+			return fmt.Errorf("'%s' does not match the expression from the allowed list: %w", s, ErrFiltered)
+		}
+	}
+
+	if denied.String() != "" {
+		deny := regexp2.MustCompile(denied.String(), 0)
+		deny.MatchTimeout = time.Until(deadline)
+
+		ok, err := deny.MatchString(s)
+		if err != nil {
+			if time.Now().After(deadline) {
+				return context.DeadlineExceeded
+			}
+			return fmt.Errorf("'%s' cannot handle '%s': %w", deny.String(), s, err)
+		}
+		if ok {
+			return fmt.Errorf("'%s' matches the expression from the denied list: %w", s, ErrFiltered)
+		}
+	}
+
+	return nil
+}

pkg/gotenberg/regexp_test.go

@@ -0,0 +1,83 @@
+package gotenberg
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/dlclark/regexp2"
+)
+
+func TestFilterDeadline(t *testing.T) {
+	for _, tc := range []struct {
+		scenario      string
+		allowed       *regexp2.Regexp
+		denied        *regexp2.Regexp
+		s             string
+		deadline      time.Time
+		expectError   bool
+		expectedError error
+	}{
+		{
+			scenario:      "DeadlineExceeded (allowed)",
+			allowed:       regexp2.MustCompile("foo", 0),
+			denied:        regexp2.MustCompile("", 0),
+			s:             "foo",
+			deadline:      time.Now().Add(time.Duration(-1) * time.Hour),
+			expectError:   true,
+			expectedError: context.DeadlineExceeded,
+		},
+		{
+			scenario:      "ErrFiltered (allowed)",
+			allowed:       regexp2.MustCompile("foo", 0),
+			denied:        regexp2.MustCompile("", 0),
+			s:             "bar",
+			deadline:      time.Now().Add(time.Duration(5) * time.Second),
+			expectError:   true,
+			expectedError: ErrFiltered,
+		},
+		{
+			scenario:      "DeadlineExceeded (denied)",
+			allowed:       regexp2.MustCompile("", 0),
+			denied:        regexp2.MustCompile("foo", 0),
+			s:             "foo",
+			deadline:      time.Now().Add(time.Duration(-1) * time.Hour),
+			expectError:   true,
+			expectedError: context.DeadlineExceeded,
+		},
+		{
+			scenario:      "ErrFiltered (denied)",
+			allowed:       regexp2.MustCompile("", 0),
+			denied:        regexp2.MustCompile("foo", 0),
+			s:             "foo",
+			deadline:      time.Now().Add(time.Duration(5) * time.Second),
+			expectError:   true,
+			expectedError: ErrFiltered,
+		},
+		{
+			scenario:    "success",
+			allowed:     regexp2.MustCompile("", 0),
+			denied:      regexp2.MustCompile("", 0),
+			s:           "foo",
+			deadline:    time.Now().Add(time.Duration(5) * time.Second),
+			expectError: false,
+		},
+	} {
+		t.Run(tc.scenario, func(t *testing.T) {
+			err := FilterDeadline(tc.allowed, tc.denied, tc.s, tc.deadline)
+
+			if tc.expectError && err == nil {
+				t.Fatal("expected an error but got none")
+			}
+
+			if !tc.expectError && err != nil {
+				t.Fatalf("expected no error but got: %v", err)
+			}
+
+			if tc.expectedError != nil && !errors.Is(err, tc.expectedError) {
+				t.Fatalf("expected error %v but got: %v", tc.expectedError, err)
+			}
+		})
+	}
+}

pkg/gotenberg/supervisor_test.go

@@ -487,10 +487,10 @@ func TestProcessSupervisor_runWithDeadline(t *testing.T) {
 			ps := NewProcessSupervisor(zap.NewNop(), new(ProcessMock), 0, 0).(*processSupervisor)
 
 			ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
-			defer cancel()
-
 			if tc.ctxDone {
 				cancel()
+			} else {
+				defer cancel()
 			}
 
 			err := ps.runWithDeadline(ctx, func() error {