linode / linode/linode-cli

[Bug]: Overly permissive regular expression range

Open
#734 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
442
Forks
159
Avg merge
7d 21h
Merged PRs (30d)
8

Description

### CLI Version

v5.56.2

### Command

https://github.com/linode/linode-cli/blob/fafe73e1f48a48ab9cbdf9b01f679e041f6bf3fa/tests/integration/stackscripts/test_stackscripts.py#L95-L95

It's easy to write a regular expression range that matches a wider range of characters than you intended. `/[a-zA-z]/` matches all lowercase and all uppercase letters, as you would expect, but it also matches the characters: `[ \ ] ^ _ ``.

Another common problem is failing to escape the dash character in a regular expression. An unescaped dash is interpreted as part of a range. For example, in the character class `[a-zA-Z0-9%=.,-_]` the last character range matches the 55 characters between `,` and `_` (both included), which overlaps with the range `[0-9]` and is clearly not intended by the writer.

### Output

_No response_

### Expected Behavior

[CWE-20

### Actual Behavior

Improper Neutralization of Special Elements used in a Command in Shell-quote
[Exploiting CVE-2021-42740](https://wh0.github.io/2021/10/28/shell-quote-rce-exploiting.html)
[no-obscure-range](https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-obscure-range.html)
[The regex [,-.]](https://pboyd.io/posts/comma-dash-dot/)
[CWE-20](https://cwe.mitre.org/data/definitions/20.html).

### Steps to Reproduce

## POC
The following code is intended to check whether a string is a valid 6 digit hex color.
```python
import re
def is_valid_hex_color(color):
return re.match(r'^#[0-9a-fA-f]{6}$', color) is not None
```
However, the `A-f` range is overly large and matches every uppercase character. It would parse a "color" like `#XXYYZZ` as valid.

The fix is to use an uppercase A-F range instead.

```python
import re
def is_valid_hex_color(color):
return re.match(r'^#[0-9a-fA-F]{6}$', color) is not None
```

## Recommendation
Avoid any confusion about which characters are included in the range by writing unambiguous regular expressions. Always check that character ranges match only the expected characters.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue points to tests/integration/stackscripts/test_stackscripts.py at line 95; inspect the regular expression there and its existing coverage. Verify that the character ranges accept only the intended characters, update the relevant test or expression, and run the associated integration test.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.