GHSA-5q95-hrpc-m3w3

### Summary

The JLine3 `HISTORY_IGNORE` variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than `*` and `:` are passed through to the regex engine. A crafted value such as `(a+)+b` can cause catastrophic backtracking each time a command line is added to history, hanging the reader thread at high CPU.

### Details

In `reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java`, `matchPatterns()` converts `HISTORY_IGNORE` into a regex:

```java for (int i = 0; i < patterns.length(); i++) { char ch = patterns.charAt(i); if (ch == '\\') { ch = patterns.charAt(++i); sb.append(ch); } else if (ch == ':') { sb.append('|'); } else if (ch == '*') { sb.append('.').append('*'); } else { sb.append(ch); } } return line.matches(sb.toString()); ```

This logic translates wildcard syntax but does not escape regex metacharacters such as `(`, `)`, `+`, `?`, `{`, `}`, `[`, and `]`. Those characters therefore reach the Java regex engine unchanged.

Affected source location: - `reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java` - `matchPatterns(String patterns, String line)`

### PoC

1. Configure `HISTORY_IGNORE` to a malicious pattern, for example:

```sh set history-ignore "(a+)+b" ```

2. At the JLine prompt, enter a long non-matching line:

```text aaaaaaaaaaaaaaaaaaaaaaaaaaax ```

3. Press Enter.

Expected result: - The prompt does not return. - The reader thread consumes high CPU.

Reproduction environment: - JLine3 on x86_64 Linux - OpenJDK 25.0.2

### Impact

This is a denial-of-service vulnerability caused by catastrophic regex backtracking. Applications embedding `org.jline:jline-reader` are impacted if they allow `HISTORY_IGNORE` to be configured through user configuration or application settings. The issue is lower severity than the interactive editor findings because the attacker must control configuration, but it can still reliably hang a reader session.

### Suggested Fix

The safest fix for the current git head is to stop treating arbitrary `HISTORY_IGNORE` content as a regex. Instead, escape all characters by default and translate only the intended JLine wildcard syntax (`*`) and separator syntax (`:`).

Suggested patch:

```diff diff --git a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java --- a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java +++ b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java @@ StringBuilder sb = new StringBuilder(); for (int i = 0; i < patterns.length(); i++) { char ch = patterns.charAt(i); if (ch == '\\') { ch = patterns.charAt(++i); - sb.append(ch); + sb.append(Pattern.quote(Character.toString(ch))); } else if (ch == ':') { sb.append('|'); } else if (ch == '*') { sb.append('.').append('*'); } else { - sb.append(ch); + sb.append(Pattern.quote(Character.toString(ch))); } } return line.matches(sb.toString()); ```

### Credits

This issue was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.