SUMMARY

expand_shorthand! (and the expand_dimensions_shorthand! it calls) runs the RE_FUNCTIONS regex over declaration values. That regex has a nested quantifier inside a group that can recurse, so on a value that opens a CSS function and never closes it, the match degrades into exponential backtracking. A CSS string of a few dozen bytes pins one CPU core for minutes to hours.

IMPACT

Any code that parses untrusted CSS and then expands shorthands is affected. That includes premailer, whose adapters call expand_shorthand! while inlining styles, so an application that runs premailer over attacker-supplied email or user CSS can be stalled by a tiny payload. The property has to be one of the dimension shorthands (margin, padding, border-*), all of which an attacker can name freely.