[Bug]: Overly permissive regular expression range
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 442
- Forks
- 159
- Avg merge
- 7d 21h
- Merged PRs (30d)
- 8
Description
### CLI Version
v5.56.2
### Command
https://github.com/linode/linode-cli/blob/fafe73e1f48a48ab9cbdf9b01f679e041f6bf3fa/tests/integration/stackscripts/test_stackscripts.py#L95-L95
It's easy to write a regular expression range that matches a wider range of characters than you intended. `/[a-zA-z]/` matches all lowercase and all uppercase letters, as you would expect, but it also matches the characters: `[ \ ] ^ _ ``.
Another common problem is failing to escape the dash character in a regular expression. An unescaped dash is interpreted as part of a range. For example, in the character class `[a-zA-Z0-9%=.,-_]` the last character range matches the 55 characters between `,` and `_` (both included), which overlaps with the range `[0-9]` and is clearly not intended by the writer.
### Output
_No response_
### Expected Behavior
[CWE-20
### Actual Behavior
Improper Neutralization of Special Elements used in a Command in Shell-quote
[Exploiting CVE-2021-42740](https://wh0.github.io/2021/10/28/shell-quote-rce-exploiting.html)
[no-obscure-range](https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-obscure-range.html)
[The regex [,-.]](https://pboyd.io/posts/comma-dash-dot/)
[CWE-20](https://cwe.mitre.org/data/definitions/20.html).
### Steps to Reproduce
## POC
The following code is intended to check whether a string is a valid 6 digit hex color.
```python
import re
def is_valid_hex_color(color):
return re.match(r'^#[0-9a-fA-f]{6}$', color) is not None
```
However, the `A-f` range is overly large and matches every uppercase character. It would parse a "color" like `#XXYYZZ` as valid.
The fix is to use an uppercase A-F range instead.
```python
import re
def is_valid_hex_color(color):
return re.match(r'^#[0-9a-fA-F]{6}$', color) is not None
```
## Recommendation
Avoid any confusion about which characters are included in the range by writing unambiguous regular expressions. Always check that character ranges match only the expected characters.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue points to tests/integration/stackscripts/test_stackscripts.py at line 95; inspect the regular expression there and its existing coverage. Verify that the character ranges accept only the intended characters, update the relevant test or expression, and run the associated integration test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100