Message fails to send if it contains word "cursor", a colon ":", and brackets "()"

[JuhaS2]

Description:

I encountered a case where Rocket.Chat fails to send a message. The message stays grey in the UI and is never sent. I am not an admin and this is not critical for me, but I thought reporting it might be helpful.

This bug appears to occur when the message contains the following three elements in this order:

1. the word "cursor" (case-insensitive)
2. a colon ":"
3. parentheses "()" (empty or with content)

Steps to reproduce:

1. Open a chat in Rocket.Chat.
2. Type a message containing the word "cursor", followed later by a colon ":" and parentheses "()".
3. Attempt to send the message.

Example minimal message:

asdf cursor asdf: asdf (asdf)

Expected behavior:

The message should be sent normally.

Actual behavior:

The message remains grey in the UI and is never sent.

Server Setup Information:

I am not admin, just a regular user, so I have no idea on the server side.

• Version of Rocket.Chat Server: unknown
• License Type: unknown
• Number of Users: unknown
• Operating System: unknown
• Deployment Method: unknown
• Number of Running Instances: unknown
• DB Replicaset Oplog: unknown
• NodeJS Version: unknown
• MongoDB Version: unknown

Client Setup Information

• Desktop App or Browser Version: unknown
• Operating System: Windows 11

Additional context

I originally encountered this when writing a message like:

The Cursor AI costs go to project: MyProject (123456)

The message failed to send until it was rewritten to avoid this pattern.

Relevant logs:

No logs collected.

[arwa-nasser2005]

Hi, I can reproduce this issue on my local environment. I'm a 3rd-year CS student and a Frontend Developer, and I'd like to investigate the message parsing logic to fix this. Could you please assign it to me?

[schourasia750]

Its working fine in my case. Also please specify the Rocket.chat version. your message seems to be just Ai copy pasted

[arwa-nasser2005]

thanks for the follow-up. I am currently using the latest develop branch for my local reproduction.
​Regarding the concern from @schourasia750, the analysis is based on actual debugging. ReDoS issues are often input-sensitive; the freeze is consistently triggered when the string pattern (like cursor:()) interacts with the specific regex used in emojione.
​I am preparing a clear screen recording to demonstrate the hang and the fix on my environment to provide full clarity. I'll share the video and the Rocket.Chat version details shortly. I'd appreciate it if I could keep working on this as I've already identified the problematic code path

[ryaverma]

I tested this issue. The message did go grey briefly but sent fine on my end. Sounds like it might be environment sensitive based on the thread. The ReDoS angle makes sense. I am not going to step on the ongoing investigation but wanted to share what I saw locally.

[adwait50]

Hi! I investigated this and found the root cause in packages/message-parser/src/grammar.pegjs. The URLScheme rule matches any word followed by : — so cursor: gets parsed as a URL scheme. When followed by (text), the PEG parser attempts URL body matching and hits catastrophic backtracking, freezing the message send. Fixed by adding a &"//" lookahead to URLScheme so it only matches when followed by //, consistent with valid URL scheme syntax. Opening a PR now!