REDoS in parseentities #86087

Activity

1. yetingli commented on Oct 3, 2020

   

   yetinglimannequin

   on Oct 3, 2020

   MannequinAuthor

   More actions

   Hi,

   I find this regex '<!ENTITY +(\w+) +CDATA +"([^"]+)" +-- +((?:.|\n)+?) *-->' may be stucked by input.
   The vulnerable regex is located in
   

   cpython/Tools/scripts/parseentities.py

   Line 18 in 8d21aa2

   entityRE = re.compile('<!ENTITY +(\w+) +CDATA +"([^"]+)" +-- +((?:.|\n)+?) *-->')

   The ReDOS vulnerability of the regex is mainly due to the sub-pattern ' +((?:.|\n)+?) *'
   and can be exploited with the following string
   '<!ENTITY a CDATA "a" -- ' + ' ' * 5000

   You can execute the following code to reproduce ReDos

   from Tools.scripts.parseentities import parse
   from time import perf_counter
   
   for i in range(0, 10000):
       ATTACK = '<!ENTITY a CDATA "a" -- ' + ' ' * i * 100
       LEN = len(ATTACK)
       BEGIN = perf_counter()
       parse(ATTACK)
       DURATION = perf_counter() - BEGIN
       print(f"{LEN}: took {DURATION} seconds!")

   Looking forward for your response​!

   Best,
   Yeting Li
2. yetingli

   added

   3.7 (EOL)end of lifeend of life

   3.8 (EOL)end of lifeend of life

   3.10 (EOL)end of lifeend of life

   3.9 (EOL)end of lifeend of life

   on Oct 3, 2020
3. pablogsal commented on Oct 5, 2020

   

   pablogsal

   on Oct 5, 2020

   Member

   More actions

   Without evaluating the validity of the regex vulnerability, is important to note that the files in Tools/scripts are not part of the standard library and therefore they aren't a valid stack vector.
4. iritkatriel

   added

   3.11only security fixesonly security fixes

   and removed

   3.7 (EOL)end of lifeend of life

   3.8 (EOL)end of lifeend of life

   on Dec 6, 2021
5. malemburg commented on Dec 6, 2021

   

   malemburg

   on Dec 6, 2021

   Member

   More actions

   Interesting that the tool still exists. It uses mxTextTools, but in a non-packaged version, so it's been broken for two decades now :-)

   I think it's safe to remove it from Tools\scripts.
6. ezio-melotti

   transferred this issue fromon Apr 10, 2022
7. ezio-melotti

   added this to html.parser issueson Jun 19, 2022
8. ezio-melotti commented on Jun 22, 2022

   

   ezio-melotti

   on Jun 22, 2022

   Member

   More actions

   Tools/scripts/parseentities.py has been removed in #92504.

   👍React with 👍1Reacted by Hugo van Kemenade
9. ezio-melotti

   closed this as completedon Jun 22, 2022
10. ezio-melotti

    moved this to Done in html.parser issueson Jun 22, 2022